From 7ffce78ce2176cd12b90deacc6cb80975dc66b42 Mon Sep 17 00:00:00 2001 From: Alex Norell Date: Wed, 21 Oct 2026 22:12:50 -0700 Subject: [PATCH 1/3] Move paid CI runners and harden workflows Move GPU jobs from the GitHub-hosted GPU runner to arc-gpu-runner-set and the two GitHub 8-core larger-runner jobs to depot-ubuntu-22.04-8. Pin all actions to commit SHAs with exact version comments, disable persisted checkout credentials, add missing job timeouts, pass secrets to run steps through env, drop unused id-token permissions and the release pip cache, and add a Dependabot entry for github-actions. --- .github/actionlint.yaml | 4 +-- .github/dependabot.yml | 16 +++++++++ .github/workflows/build-osx-bundle.yml | 11 +++--- .../workflows/build-windows-installer-cpu.yml | 13 ++++--- .../workflows/build-windows-installer-gpu.yml | 13 ++++--- .../check_if_branch_is_mergeable.yml | 1 + .github/workflows/check_model_licenses.yml | 5 ++- .github/workflows/ci_image_build.yml | 4 +-- .github/workflows/claude-pr-review.yml | 10 +++--- .github/workflows/docker.cpu.parallel.yml | 14 ++++---- .github/workflows/docker.cpu.slim.yml | 14 ++++---- .github/workflows/docker.cpu.yml | 16 +++++---- .github/workflows/docker.gpu.cu13.yml | 14 ++++---- .github/workflows/docker.gpu.parallel.yml | 10 +++--- .github/workflows/docker.gpu.slim.yml | 10 +++--- .github/workflows/docker.gpu.udp.yml | 10 +++--- .github/workflows/docker.gpu.yml | 12 ++++--- .github/workflows/docker.inference-exp.yml | 15 +++++--- .github/workflows/docker.inference_server.yml | 15 +++++--- .github/workflows/docker.jetson.5.1.1.yml | 10 +++--- .github/workflows/docker.jetson.6.2.0.yml | 10 +++--- .github/workflows/docker.jetson.7.2.0.yml | 12 ++++--- .../workflows/docker.media.jetson.7.2.0.yml | 10 +++--- .github/workflows/docker.trt.yml | 10 +++--- .../workflows/docker.wheels.jetson.7.2.0.yml | 28 ++++++++------- .github/workflows/docs.yml | 9 ++--- .../e2e_tests_inference_experimental_cpu.yml | 10 +++--- .../e2e_tests_inference_experimental_gpu.yml | 16 +++++---- .../fast_track_integration_tests.yml | 2 ++ .../hosted_inference_e2e_repository.yml | 24 ++++++------- .../hosted_inference_e2e_sharded.yml | 26 +++++++------- ...ntegration_e2e_tests_inference_sdk_x86.yml | 16 +++++---- ...ference_cli_depending_on_inference_x86.yml | 8 +++-- .../integration_tests_inference_cli_x86.yml | 8 +++-- ...ation_tests_inference_experimental_cpu.yml | 20 +++++++++-- ...ation_tests_inference_experimental_gpu.yml | 12 ++++--- .../integration_tests_inference_models.yml | 10 +++--- ...integration_tests_inference_server_x86.yml | 11 +++--- ...tion_tests_workflows_tensor_native_x86.yml | 10 +++--- .../integration_tests_workflows_x86.yml | 22 ++++++++---- .../workflows/load_test_hosted_inference.yml | 10 +++--- .github/workflows/maintainer-review-slack.yml | 3 +- .../modal.custom_python_block.deploy.yml | 7 ++-- .github/workflows/probe_google_colab.yml | 11 +++--- .../workflows/publish.pypi.inference_exp.yml | 8 +++-- .../publish.pypi.inference_server_stack.yml | 14 +++++--- .../publish.pypi.roboflow_workflows.yml | 10 +++--- .../workflows/publish.pypi.streamvision.yml | 10 +++--- .github/workflows/publish.pypi.yml | 15 +++----- .github/workflows/static_code_analysis.yml | 4 ++- .github/workflows/test.colab.cpu.yml | 15 ++++---- .github/workflows/test.colab.gpu.yml | 14 ++++---- .github/workflows/test.jetson_4.6.1.yml | 12 ++++--- .github/workflows/test.jetson_5.1.1.yml | 12 ++++--- .github/workflows/test.jetson_6.0.0.yml | 12 ++++--- .github/workflows/test.nvidia_t4.yml | 8 ++--- .../test.nvidia_t4_parallel_server.yml | 36 +++++++++++++++---- .../test_package_install_inference.yml | 11 +++--- .../test_package_install_inference_cli.yml | 11 +++--- .../test_package_install_inference_gpu.yml | 13 +++---- ...kage_install_inference_gpu_with_extras.yml | 13 +++---- .../test_package_install_inference_sdk.yml | 11 +++--- ..._package_install_inference_with_extras.yml | 11 +++--- .../unit_tests_inference_cli_x86.yml | 8 +++-- .../unit_tests_inference_experimental.yml | 6 ++-- .../unit_tests_inference_experimental_gpu.yml | 12 ++++--- ...sts_inference_model_manager_and_server.yml | 8 +++-- .../unit_tests_inference_sdk_x86.yml | 8 +++-- .../workflows/unit_tests_inference_x86.yml | 8 +++-- .../workflows/unit_tests_streamvision_x86.yml | 8 +++-- ...unit_tests_workflows_tensor_native_x86.yml | 16 +++++---- .../workflows/unit_tests_workflows_x86.yml | 16 +++++---- .github/workflows/validate.github-actions.yml | 7 ++-- CLAUDE.md | 22 ++++++++++++ 74 files changed, 552 insertions(+), 329 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index 3cfb2519ea..40df948fdc 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -1,10 +1,10 @@ -# Depot and Jetson runners are organization-managed labels, not GitHub-hosted +# Depot, ARC GPU and Jetson runners are organization-managed labels, not GitHub-hosted # runner labels. Allow them while retaining actionlint's runner validation for # every other label. self-hosted-runner: labels: - depot-ubuntu-* - - Roboflow-GPU-VM-Runner + - arc-gpu-runner-set - jetpack-* - jetson diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..697f4062a5 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,16 @@ +version: 2 +updates: + # Keeps the SHA-pinned actions (and their version comments) current. One + # grouped PR per month limits CI runs spent on action bumps. + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: monthly + # Skip releases younger than a week, so a compromised tag has time to be + # caught before it is pinned here. + cooldown: + default-days: 7 + groups: + github-actions: + patterns: + - "*" diff --git a/.github/workflows/build-osx-bundle.yml b/.github/workflows/build-osx-bundle.yml index eee833ce53..63ae856811 100644 --- a/.github/workflows/build-osx-bundle.yml +++ b/.github/workflows/build-osx-bundle.yml @@ -12,6 +12,7 @@ on: jobs: build_osx: runs-on: macos-14 + timeout-minutes: 120 permissions: contents: write env: @@ -20,11 +21,13 @@ jobs: NOTARY_PROFILE_NAME: "roboflow-notary" steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false # No 'path' means checkout to the root - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' @@ -189,7 +192,7 @@ jobs: run: python build.py - name: Upload macOS DMG Artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: Roboflow-Inference-DMG-${{ steps.determine_version.outputs.BUILD_VERSION_ENV || 'dev' }} # Add version to artifact name path: app_bundles/osx/Roboflow-Inference-${{ steps.determine_version.outputs.BUILD_VERSION_ENV || 'unknown' }}.dmg @@ -197,7 +200,7 @@ jobs: - name: Upload DMG to Release if: github.event_name == 'release' && steps.determine_version.outputs.BUILD_VERSION_ENV != '0.0.0-manual-dev' && steps.determine_version.outputs.BUILD_VERSION_ENV != '' - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/build-windows-installer-cpu.yml b/.github/workflows/build-windows-installer-cpu.yml index 013d1ed66e..cdc58b0b15 100644 --- a/.github/workflows/build-windows-installer-cpu.yml +++ b/.github/workflows/build-windows-installer-cpu.yml @@ -12,15 +12,18 @@ on: jobs: build_windows: runs-on: Windows-2022 + timeout-minutes: 90 permissions: contents: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false # No 'path' means checkout to the root - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' @@ -86,7 +89,7 @@ jobs: - name: Install DigiCert Client tools id: install_digicert_tools # Renamed for clarity - uses: digicert/ssm-code-signing@v1.2.1 + uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1 - name: Set DigiCert certificate @@ -335,7 +338,7 @@ jobs: echo "Installer signed successfully (based on smctl exit code and absence of 'FAILED' in CLI output). Review logs carefully." - name: Upload Windows Installer - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: Roboflow-Inference-Windows-Installer # The build.py script creates the installer in installer/inference-{version}-installer.exe @@ -345,7 +348,7 @@ jobs: - name: Upload Installer to Release if: github.event_name == 'release' - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/build-windows-installer-gpu.yml b/.github/workflows/build-windows-installer-gpu.yml index 9ffae0e6d0..6c5f42eff7 100644 --- a/.github/workflows/build-windows-installer-gpu.yml +++ b/.github/workflows/build-windows-installer-gpu.yml @@ -12,15 +12,18 @@ on: jobs: build_windows: runs-on: Windows-2022 + timeout-minutes: 120 permissions: contents: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false # No 'path' means checkout to the root - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' @@ -139,7 +142,7 @@ jobs: - name: Install DigiCert Client tools id: install_digicert_tools # Renamed for clarity - uses: digicert/ssm-code-signing@v1.2.1 + uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1 - name: Set DigiCert certificate @@ -388,7 +391,7 @@ jobs: echo "Installer signed successfully (based on smctl exit code and absence of 'FAILED' in CLI output). Review logs carefully." - name: Upload Windows Installer - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: Roboflow-Inference-Windows-Installer # The build.py script creates the installer in installer/inference-{version}-installer.exe @@ -398,7 +401,7 @@ jobs: - name: Upload Installer to Release if: github.event_name == 'release' - uses: actions/upload-release-asset@v1 + uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/check_if_branch_is_mergeable.yml b/.github/workflows/check_if_branch_is_mergeable.yml index 91700949ae..59ebe7266c 100644 --- a/.github/workflows/check_if_branch_is_mergeable.yml +++ b/.github/workflows/check_if_branch_is_mergeable.yml @@ -12,6 +12,7 @@ jobs: check_if_branch_is_mergeable: name: Check if branch is mergeable runs-on: ubuntu-latest + timeout-minutes: 10 outputs: mergeable_state: ${{ steps.mergeable_check.outputs.mergeable_state }} steps: diff --git a/.github/workflows/check_model_licenses.yml b/.github/workflows/check_model_licenses.yml index e79a36c2e4..ade01d8abf 100644 --- a/.github/workflows/check_model_licenses.yml +++ b/.github/workflows/check_model_licenses.yml @@ -19,9 +19,12 @@ concurrency: jobs: validate-models: runs-on: ubuntu-latest + timeout-minutes: 30 steps: - name: "Checkout repository" - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: "Validate model directories" run: | diff --git a/.github/workflows/ci_image_build.yml b/.github/workflows/ci_image_build.yml index 00f85a11f0..61ddcf9926 100644 --- a/.github/workflows/ci_image_build.yml +++ b/.github/workflows/ci_image_build.yml @@ -57,9 +57,9 @@ jobs: CI_DEPOT_ACTION: validate run: python3 .github/scripts/depot_ci_image.py - name: Set up Depot CLI - uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Set up Buildx for manifest inspection - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Save image once and record platform digests id: build env: diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml index 5236c66327..2cbcf808d6 100644 --- a/.github/workflows/claude-pr-review.yml +++ b/.github/workflows/claude-pr-review.yml @@ -52,6 +52,7 @@ jobs: ) ) runs-on: ubuntu-latest + timeout-minutes: 10 outputs: should_review: ${{ steps.gate.outputs.should_review }} number: ${{ steps.gate.outputs.number }} @@ -153,7 +154,7 @@ jobs: steps: - name: Checkout trusted base branch - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ needs.gate.outputs.base_sha }} fetch-depth: 1 @@ -212,7 +213,7 @@ jobs: # Keep the agent's working directory and configuration on the trusted base. # PR source is data in a subdirectory, never a shell/action working directory. - name: Checkout PR source for static reading - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ needs.gate.outputs.head_sha }} path: review-source @@ -284,13 +285,14 @@ jobs: needs: [gate, review] if: needs.gate.outputs.should_review == 'true' && fromJSON(needs.review.outputs.verdict || '{}').verdict == 'pass' runs-on: ubuntu-latest + timeout-minutes: 10 permissions: contents: read pull-requests: read steps: # A fresh runner, trusted base code, and NO Slack credentials. The agent's # workspace and processes cannot affect this collector. - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ needs.gate.outputs.base_sha }} persist-credentials: false @@ -314,7 +316,7 @@ jobs: run: '"$RUNNER_TEMP/maintainer-review/bin/python" .github/scripts/maintainer_review.py collect' - name: Publish handoff data if: steps.result.outputs.ready == 'true' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: maintainer-review-result-${{ github.run_attempt }} path: ${{ runner.temp }}/result.json diff --git a/.github/workflows/docker.cpu.parallel.yml b/.github/workflows/docker.cpu.parallel.yml index 1c64a93fc9..3d58d4ff2b 100644 --- a/.github/workflows/docker.cpu.parallel.yml +++ b/.github/workflows/docker.cpu.parallel.yml @@ -37,21 +37,23 @@ jobs: PUBLISH: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true') }} steps: - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 # Publishing runs push amd64 by digest, test that exact image, then reuse # the same digest in the multi-arch tags. Other runs only load and test. - name: Build and load CPU image (amd64) if: ${{ env.PUBLISH != 'true' }} - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: false project: grl7ffzxd7 @@ -63,7 +65,7 @@ jobs: - name: Build and push CPU image by digest (amd64) id: amd64 if: ${{ env.PUBLISH == 'true' }} - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: project: grl7ffzxd7 context: . @@ -88,7 +90,7 @@ jobs: # arm64 is built but not runtime-tested. - name: Build CPU image and optionally push by digest (arm64) id: arm64 - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: project: grl7ffzxd7 context: . diff --git a/.github/workflows/docker.cpu.slim.yml b/.github/workflows/docker.cpu.slim.yml index f385e11d55..ea547b0ee6 100644 --- a/.github/workflows/docker.cpu.slim.yml +++ b/.github/workflows/docker.cpu.slim.yml @@ -38,21 +38,23 @@ jobs: PUBLISH: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true') }} steps: - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 # Publishing runs push amd64 by digest, test that exact image, then reuse # the same digest in the multi-arch tags. Other runs only load and test. - name: Build and load CPU image (amd64) if: ${{ env.PUBLISH != 'true' }} - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: false project: grl7ffzxd7 @@ -64,7 +66,7 @@ jobs: - name: Build and push CPU image by digest (amd64) id: amd64 if: ${{ env.PUBLISH == 'true' }} - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: project: grl7ffzxd7 context: . @@ -89,7 +91,7 @@ jobs: # arm64 is built but not runtime-tested. - name: Build CPU image and optionally push by digest (arm64) id: arm64 - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: project: grl7ffzxd7 context: . diff --git a/.github/workflows/docker.cpu.yml b/.github/workflows/docker.cpu.yml index 90da70f754..8fa6c744e8 100644 --- a/.github/workflows/docker.cpu.yml +++ b/.github/workflows/docker.cpu.yml @@ -72,6 +72,8 @@ jobs: exit 1 - name: Checkout uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Determine Image Tags @@ -92,14 +94,14 @@ jobs: first="${IMAGE_TAGS%%,*}" echo "image_tag=${first#"$BASE_IMAGE:"}" >> "$GITHUB_OUTPUT" - name: Set up Depot CLI - uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Login to Docker Hub - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Authenticate gcloud - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 id: auth with: workload_identity_provider: "projects/878913763597/locations/global/workloadIdentityPools/github-actions/providers/github" @@ -107,7 +109,7 @@ jobs: token_format: access_token create_credentials_file: false - name: Login to Google Artifact Registry - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: us-docker.pkg.dev username: oauth2accesstoken @@ -134,7 +136,7 @@ jobs: # the same digest in the multi-arch tags. Other runs only load and test. - name: Build and load CPU image (amd64) if: ${{ env.PUBLISH != 'true' }} - uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: false project: grl7ffzxd7 @@ -146,7 +148,7 @@ jobs: - name: Build and push CPU image by digest (amd64) id: amd64 if: ${{ env.PUBLISH == 'true' }} - uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: project: grl7ffzxd7 context: . @@ -171,7 +173,7 @@ jobs: # arm64 is built but not runtime-tested. - name: Build CPU image and optionally push by digest (arm64) id: arm64 - uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: project: grl7ffzxd7 context: . diff --git a/.github/workflows/docker.gpu.cu13.yml b/.github/workflows/docker.gpu.cu13.yml index baeaac44c4..4071193bde 100644 --- a/.github/workflows/docker.gpu.cu13.yml +++ b/.github/workflows/docker.gpu.cu13.yml @@ -40,7 +40,9 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Determine Image Tags @@ -53,21 +55,21 @@ jobs: force_push: ${{ github.event.inputs.force_push }} token: ${{ secrets.GITHUB_TOKEN }} - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Authenticate gcloud - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13 id: auth with: workload_identity_provider: "projects/878913763597/locations/global/workloadIdentityPools/github-actions/providers/github" service_account: "gha-inference@roboflow-staging.iam.gserviceaccount.com" token_format: access_token - name: Login to Google Artifact Registry - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: us-docker.pkg.dev username: oauth2accesstoken @@ -91,7 +93,7 @@ jobs: echo "Single build will push to Docker Hub and Artifact Registry:" echo "${DH_TAGS},${GCP_TAGS}" - name: Build and push (Docker Hub and GCP from one build) - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true') }} project: grl7ffzxd7 diff --git a/.github/workflows/docker.gpu.parallel.yml b/.github/workflows/docker.gpu.parallel.yml index 9c1cb54cac..adc70370db 100644 --- a/.github/workflows/docker.gpu.parallel.yml +++ b/.github/workflows/docker.gpu.parallel.yml @@ -34,18 +34,20 @@ jobs: contents: read steps: - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Build and Push - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true')}} project: grl7ffzxd7 diff --git a/.github/workflows/docker.gpu.slim.yml b/.github/workflows/docker.gpu.slim.yml index 8ce9f59fdb..cdea550758 100644 --- a/.github/workflows/docker.gpu.slim.yml +++ b/.github/workflows/docker.gpu.slim.yml @@ -34,18 +34,20 @@ jobs: contents: read steps: - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Build and Push - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true')}} project: grl7ffzxd7 diff --git a/.github/workflows/docker.gpu.udp.yml b/.github/workflows/docker.gpu.udp.yml index 36f94cd629..97d003ca4f 100644 --- a/.github/workflows/docker.gpu.udp.yml +++ b/.github/workflows/docker.gpu.udp.yml @@ -34,18 +34,20 @@ jobs: contents: read steps: - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Build and Push - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true')}} project: grl7ffzxd7 diff --git a/.github/workflows/docker.gpu.yml b/.github/workflows/docker.gpu.yml index 5de51f09e3..88b073bd6e 100644 --- a/.github/workflows/docker.gpu.yml +++ b/.github/workflows/docker.gpu.yml @@ -70,6 +70,8 @@ jobs: exit 1 - name: Checkout uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Determine Image Tags @@ -90,21 +92,21 @@ jobs: first="${IMAGE_TAGS%%,*}" echo "image_tag=${first#"$BASE_IMAGE:"}" >> "$GITHUB_OUTPUT" - name: Set up Depot CLI - uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Login to Docker Hub - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Authenticate gcloud - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2 + uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13 id: auth with: workload_identity_provider: "projects/878913763597/locations/global/workloadIdentityPools/github-actions/providers/github" service_account: "gha-inference@roboflow-staging.iam.gserviceaccount.com" token_format: access_token - name: Login to Google Artifact Registry - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: us-docker.pkg.dev username: oauth2accesstoken @@ -128,7 +130,7 @@ jobs: echo "Single build will push to Docker Hub and Artifact Registry:" echo "${DH_TAGS},${GCP_TAGS}" - name: Build and push (Docker Hub and GCP from one build) - uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: ${{ github.event_name == 'release' || inputs.force_push == true }} project: grl7ffzxd7 diff --git a/.github/workflows/docker.inference-exp.yml b/.github/workflows/docker.inference-exp.yml index b247f0fe8c..daeae4ffbd 100644 --- a/.github/workflows/docker.inference-exp.yml +++ b/.github/workflows/docker.inference-exp.yml @@ -36,13 +36,16 @@ env: jobs: determine-tags: runs-on: ubuntu-latest + timeout-minutes: 10 permissions: contents: read outputs: base-tag: ${{ steps.tags.outputs.base-tag }} steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from pyproject.toml run: | @@ -119,7 +122,9 @@ jobs: - name: Checkout code if: steps.should-build.outputs.should-build == 'true' - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Determine image tags if: steps.should-build.outputs.should-build == 'true' @@ -162,16 +167,16 @@ jobs: printf 'tags=%s\n' "$TAGS" >> "$GITHUB_OUTPUT" - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Set up Depot if: steps.should-build.outputs.should-build == 'true' - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Build and push ${{ matrix.platform }} image if: steps.should-build.outputs.should-build == 'true' - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true')}} project: grl7ffzxd7 diff --git a/.github/workflows/docker.inference_server.yml b/.github/workflows/docker.inference_server.yml index 67e2401653..0bf1aa311e 100644 --- a/.github/workflows/docker.inference_server.yml +++ b/.github/workflows/docker.inference_server.yml @@ -45,6 +45,7 @@ env: jobs: setup: runs-on: ubuntu-latest + timeout-minutes: 10 outputs: matrix: ${{ steps.set.outputs.matrix }} server_version: ${{ steps.ver.outputs.server_version }} @@ -52,7 +53,9 @@ jobs: models_version: ${{ steps.ver.outputs.models_version }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read package versions id: ver run: | @@ -105,17 +108,19 @@ jobs: name: build-${{ matrix.name }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 # jp5.1.1 base (roboflow/l4t-ml) is private on Docker Hub. - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Build (and optionally push) - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: project: ${{ matrix.depot_project }} context: . diff --git a/.github/workflows/docker.jetson.5.1.1.yml b/.github/workflows/docker.jetson.5.1.1.yml index f921f0ea52..2a24ff15d9 100644 --- a/.github/workflows/docker.jetson.5.1.1.yml +++ b/.github/workflows/docker.jetson.5.1.1.yml @@ -39,12 +39,14 @@ jobs: contents: read steps: - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Determine Image Tags @@ -57,9 +59,9 @@ jobs: force_push: ${{ github.event.inputs.force_push }} token: ${{ secrets.GITHUB_TOKEN }} - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Build and Push - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true')}} project: grl7ffzxd7 diff --git a/.github/workflows/docker.jetson.6.2.0.yml b/.github/workflows/docker.jetson.6.2.0.yml index a05b5ea4fa..355c22d7ba 100644 --- a/.github/workflows/docker.jetson.6.2.0.yml +++ b/.github/workflows/docker.jetson.6.2.0.yml @@ -43,12 +43,14 @@ jobs: contents: read steps: - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Determine Image Tags @@ -61,9 +63,9 @@ jobs: force_push: ${{ github.event.inputs.force_push }} token: ${{ secrets.GITHUB_TOKEN }} - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Build and Push - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true')}} project: 2rp7mfjw7q diff --git a/.github/workflows/docker.jetson.7.2.0.yml b/.github/workflows/docker.jetson.7.2.0.yml index d00db0d2cb..8a29d21cfc 100644 --- a/.github/workflows/docker.jetson.7.2.0.yml +++ b/.github/workflows/docker.jetson.7.2.0.yml @@ -45,12 +45,14 @@ jobs: contents: read steps: - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> "$GITHUB_ENV" - name: Determine Image Tags @@ -63,7 +65,7 @@ jobs: force_push: ${{ github.event.inputs.force_push }} token: ${{ secrets.GITHUB_TOKEN }} - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Validate media rebuild tag if: ${{ inputs.rebuild_media }} env: @@ -77,7 +79,7 @@ jobs: - name: Build media image from current ref if: ${{ inputs.rebuild_media }} id: media - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: project: v1xzfwkc4b context: . @@ -98,7 +100,7 @@ jobs: fi printf 'JETSON_MEDIA_IMAGE=%s:%s-media@%s\n' "$MEDIA_BASE_IMAGE" "$CUSTOM_TAG" "$MEDIA_DIGEST" >> "$GITHUB_ENV" - name: Build image - uses: depot/bake-action@v1 + uses: depot/bake-action@1d58c2668346981089b088b7ef36755b206b20e9 # v1.13.0 env: JETSON_SERVER_TAGS: ${{ steps.tags.outputs.image_tags }} with: diff --git a/.github/workflows/docker.media.jetson.7.2.0.yml b/.github/workflows/docker.media.jetson.7.2.0.yml index 5c05dce1ed..dec9b1d074 100644 --- a/.github/workflows/docker.media.jetson.7.2.0.yml +++ b/.github/workflows/docker.media.jetson.7.2.0.yml @@ -48,12 +48,14 @@ jobs: steps: - name: Login to Docker Hub if: ${{ github.event_name == 'release' || inputs.force_push == true }} - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> "$GITHUB_ENV" - name: Determine image tags @@ -66,9 +68,9 @@ jobs: force_push: ${{ inputs.force_push }} token: ${{ secrets.GITHUB_TOKEN }} - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Build image - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: project: v1xzfwkc4b context: . diff --git a/.github/workflows/docker.trt.yml b/.github/workflows/docker.trt.yml index 7552e70381..57ed44db5b 100644 --- a/.github/workflows/docker.trt.yml +++ b/.github/workflows/docker.trt.yml @@ -34,18 +34,20 @@ jobs: contents: read steps: - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> $GITHUB_ENV - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Build and Push - uses: depot/build-push-action@v1 + uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: push: ${{ github.event_name == 'release' || (github.event.inputs.force_push == 'true')}} project: grl7ffzxd7 diff --git a/.github/workflows/docker.wheels.jetson.7.2.0.yml b/.github/workflows/docker.wheels.jetson.7.2.0.yml index dc548a188f..31a8b6e5b6 100644 --- a/.github/workflows/docker.wheels.jetson.7.2.0.yml +++ b/.github/workflows/docker.wheels.jetson.7.2.0.yml @@ -50,13 +50,15 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Build Torch id: torch background: true - uses: depot/bake-action@v1 + uses: depot/bake-action@1d58c2668346981089b088b7ef36755b206b20e9 # v1.13.0 with: files: ./docker/docker-bake.jetson.7.2.0.hcl targets: jetson-wheels-torch-jp72 @@ -64,19 +66,19 @@ jobs: - parallel: - name: Build ONNX Runtime - uses: depot/bake-action@v1 + uses: depot/bake-action@1d58c2668346981089b088b7ef36755b206b20e9 # v1.13.0 with: files: ./docker/docker-bake.jetson.7.2.0.hcl targets: jetson-wheels-ort-jp72 project: v1xzfwkc4b - name: Fetch Triton - uses: depot/bake-action@v1 + uses: depot/bake-action@1d58c2668346981089b088b7ef36755b206b20e9 # v1.13.0 with: files: ./docker/docker-bake.jetson.7.2.0.hcl targets: jetson-wheels-triton-jp72 project: v1xzfwkc4b - name: Build PyCUDA - uses: depot/bake-action@v1 + uses: depot/bake-action@1d58c2668346981089b088b7ef36755b206b20e9 # v1.13.0 with: files: ./docker/docker-bake.jetson.7.2.0.hcl targets: jetson-wheels-pycuda-jp72 @@ -87,13 +89,13 @@ jobs: - parallel: - name: Build torchvision - uses: depot/bake-action@v1 + uses: depot/bake-action@1d58c2668346981089b088b7ef36755b206b20e9 # v1.13.0 with: files: ./docker/docker-bake.jetson.7.2.0.hcl targets: jetson-wheels-torchvision-jp72 project: v1xzfwkc4b - name: Build FlashAttention - uses: depot/bake-action@v1 + uses: depot/bake-action@1d58c2668346981089b088b7ef36755b206b20e9 # v1.13.0 with: files: ./docker/docker-bake.jetson.7.2.0.hcl targets: jetson-wheels-flash-attn-jp72 @@ -112,12 +114,14 @@ jobs: steps: - name: Login to Docker Hub if: ${{ github.event_name == 'release' || inputs.force_push == true }} - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Read version from file run: echo "VERSION=$(DISABLE_VERSION_CHECK=true python ./inference/core/version.py)" >> "$GITHUB_ENV" - name: Determine image tags @@ -130,9 +134,9 @@ jobs: force_push: ${{ inputs.force_push }} token: ${{ secrets.GITHUB_TOKEN }} - name: Set up Depot CLI - uses: depot/setup-action@v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Build image - uses: depot/bake-action@v1 + uses: depot/bake-action@1d58c2668346981089b088b7ef36755b206b20e9 # v1.13.0 env: JETSON_WHEELS_TAGS: ${{ steps.tags.outputs.image_tags }} with: diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 27f4560a06..a379a12a5d 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -38,13 +38,14 @@ jobs: steps: - name: Check out inference repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: + persist-credentials: false path: inference_repo fetch-depth: 0 - name: Set up Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "22" @@ -58,7 +59,7 @@ jobs: working-directory: ./inference_repo/theme_build - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" check-latest: true @@ -108,7 +109,7 @@ jobs: - name: Upload site artifact if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request' }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: docs-site-preview path: ./inference_repo/site diff --git a/.github/workflows/e2e_tests_inference_experimental_cpu.yml b/.github/workflows/e2e_tests_inference_experimental_cpu.yml index 500f7f0060..1601451495 100644 --- a/.github/workflows/e2e_tests_inference_experimental_cpu.yml +++ b/.github/workflows/e2e_tests_inference_experimental_cpu.yml @@ -22,23 +22,25 @@ jobs: timeout-minutes: 30 steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/uv key: ${{ runner.os }}-uv-3.12-${{ hashFiles('inference_models/pyproject.toml') }} restore-keys: | ${{ runner.os }}-uv-3.12- - name: ๐Ÿ“ฆ Cache apt packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/apt-cache key: ${{ runner.os }}-apt-cuda-12-4 restore-keys: | ${{ runner.os }}-apt-cuda- - name: ๐Ÿ Set up Python 3.12 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: 3.12 check-latest: true diff --git a/.github/workflows/e2e_tests_inference_experimental_gpu.yml b/.github/workflows/e2e_tests_inference_experimental_gpu.yml index a18da0581e..daf26d62f1 100644 --- a/.github/workflows/e2e_tests_inference_experimental_gpu.yml +++ b/.github/workflows/e2e_tests_inference_experimental_gpu.yml @@ -16,27 +16,29 @@ concurrency: jobs: e2e-tests-inference-models-gpu: - runs-on: Roboflow-GPU-VM-Runner + runs-on: arc-gpu-runner-set timeout-minutes: 30 steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/uv key: ${{ runner.os }}-uv-3.12-${{ hashFiles('inference_models/pyproject.toml') }} restore-keys: | ${{ runner.os }}-uv-3.12- - name: ๐Ÿ“ฆ Cache apt packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/apt-cache key: ${{ runner.os }}-apt-cuda-12-4 restore-keys: | ${{ runner.os }}-apt-cuda- - name: ๐Ÿ Set up Python 3.12 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: 3.12 check-latest: true @@ -73,6 +75,8 @@ jobs: - name: ๐Ÿงช Run E2E tests working-directory: inference_models timeout-minutes: 20 + env: + ROBOFLOW_API_KEY: ${{ secrets.LOAD_TEST_PRODUCTION_API_KEY }} run: | source .venv/bin/activate - ROBOFLOW_API_KEY=${{ secrets.LOAD_TEST_PRODUCTION_API_KEY }} python -m pytest -m "e2e_model_inference and not cpu_only" tests/e2e_platform_tests + python -m pytest -m "e2e_model_inference and not cpu_only" tests/e2e_platform_tests diff --git a/.github/workflows/fast_track_integration_tests.yml b/.github/workflows/fast_track_integration_tests.yml index c542ecca8c..b4f471b57a 100644 --- a/.github/workflows/fast_track_integration_tests.yml +++ b/.github/workflows/fast_track_integration_tests.yml @@ -94,6 +94,8 @@ jobs: version: ${{ steps.resolve.outputs.version }} steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Resolve id: resolve env: diff --git a/.github/workflows/hosted_inference_e2e_repository.yml b/.github/workflows/hosted_inference_e2e_repository.yml index b128cacc31..0b43530cc5 100644 --- a/.github/workflows/hosted_inference_e2e_repository.yml +++ b/.github/workflows/hosted_inference_e2e_repository.yml @@ -56,7 +56,7 @@ jobs: approved_ref: ${{ steps.authorize.outputs.approved_ref }} approved_sha: ${{ steps.authorize.outputs.approved_sha }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.sha }} persist-credentials: false @@ -74,11 +74,11 @@ jobs: group: public-depot timeout-minutes: 30 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.sha }} persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 @@ -106,7 +106,7 @@ jobs: .venv/bin/python .github/scripts/hosted_e2e_repository.py prepare - name: Retain encrypted evidence only if: ${{ always() }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: hosted-encrypted-${{ github.run_id }}-${{ github.run_attempt }}-prepare path: encrypted/*.bin @@ -128,11 +128,11 @@ jobs: matrix: shard: [A, B, C, D] steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.sha }} persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 @@ -143,7 +143,7 @@ jobs: run: | uv venv .venv uv pip install --python .venv/bin/python 'pytest==8.4.2' 'pytest-retry==1.6.3' 'click==8.1.8' 'cryptography==46.0.3' - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: hosted-encrypted-${{ github.run_id }}-${{ github.run_attempt }}-prepare path: incoming @@ -164,7 +164,7 @@ jobs: .venv/bin/python .github/scripts/hosted_e2e_repository.py shard --shard "${{ matrix.shard }}" - name: Retain encrypted evidence only if: ${{ always() }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: hosted-encrypted-${{ github.run_id }}-${{ github.run_attempt }}-shard-${{ matrix.shard }} path: encrypted/*.bin @@ -182,11 +182,11 @@ jobs: group: public-depot timeout-minutes: 30 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.sha }} persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 @@ -197,7 +197,7 @@ jobs: run: | uv venv .venv uv pip install --python .venv/bin/python 'pytest==8.4.2' 'pytest-retry==1.6.3' 'click==8.1.8' 'cryptography==46.0.3' - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 continue-on-error: true with: pattern: hosted-encrypted-${{ github.run_id }}-${{ github.run_attempt }}-* @@ -218,7 +218,7 @@ jobs: test "$SHARDS_RESULT" = success - name: Retain encrypted evidence only if: ${{ always() }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: hosted-encrypted-${{ github.run_id }}-${{ github.run_attempt }}-aggregate path: encrypted/*.bin diff --git a/.github/workflows/hosted_inference_e2e_sharded.yml b/.github/workflows/hosted_inference_e2e_sharded.yml index e3105a0777..460292d99c 100644 --- a/.github/workflows/hosted_inference_e2e_sharded.yml +++ b/.github/workflows/hosted_inference_e2e_sharded.yml @@ -92,7 +92,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 30 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: repository: roboflow/inference ref: main @@ -106,13 +106,13 @@ jobs: git merge-base --is-ancestor "$HOSTED_E2E_RUNNER_SHA" origin/main git show "$HOSTED_E2E_RUNNER_SHA:.github/scripts/hosted_e2e.py" > "$RUNNER_TEMP/hosted_e2e.py" git checkout --detach "$HOSTED_E2E_TEST_SHA" - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: repository: ${{ github.repository }} ref: ${{ github.sha }} path: policy persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 @@ -143,7 +143,7 @@ jobs: python "$RUNNER_TEMP/hosted_e2e.py" warmup - name: Retain private preparation evidence if: ${{ always() }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: hosted-plan-${{ github.run_id }}-${{ github.run_attempt }} path: | @@ -165,7 +165,7 @@ jobs: matrix: shard: [A, B, C, D] steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: repository: roboflow/inference ref: main @@ -179,20 +179,20 @@ jobs: git merge-base --is-ancestor "$HOSTED_E2E_RUNNER_SHA" origin/main git show "$HOSTED_E2E_RUNNER_SHA:.github/scripts/hosted_e2e.py" > "$RUNNER_TEMP/hosted_e2e.py" git checkout --detach "$HOSTED_E2E_TEST_SHA" - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: repository: ${{ github.repository }} ref: ${{ github.sha }} path: policy persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: version: "0.11.31" enable-cache: false - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: hosted-plan-${{ github.run_id }}-${{ github.run_attempt }} path: inference/evidence @@ -216,7 +216,7 @@ jobs: python "$RUNNER_TEMP/hosted_e2e.py" shard --shard "${{ matrix.shard }}" - name: Retain private shard evidence even after failure if: ${{ always() }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: hosted-shard-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.shard }} path: inference/evidence/shard-${{ matrix.shard }}.json @@ -229,7 +229,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: repository: roboflow/inference ref: main @@ -243,7 +243,7 @@ jobs: git merge-base --is-ancestor "$HOSTED_E2E_RUNNER_SHA" origin/main git show "$HOSTED_E2E_RUNNER_SHA:.github/scripts/hosted_e2e.py" > "$RUNNER_TEMP/hosted_e2e.py" git checkout --detach "$HOSTED_E2E_TEST_SHA" - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 @@ -252,7 +252,7 @@ jobs: enable-cache: false - name: Download all available evidence from this attempt continue-on-error: true - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: pattern: hosted-*-${{ github.run_id }}-${{ github.run_attempt }}* path: inference/evidence @@ -270,7 +270,7 @@ jobs: test "$SHARD_RESULT" = success - name: Retain private acceptance details if: ${{ always() }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: hosted-acceptance-${{ github.run_id }}-${{ github.run_attempt }} path: inference/evidence/acceptance.json diff --git a/.github/workflows/integration_e2e_tests_inference_sdk_x86.yml b/.github/workflows/integration_e2e_tests_inference_sdk_x86.yml index 37f78834f2..02df62522c 100644 --- a/.github/workflows/integration_e2e_tests_inference_sdk_x86.yml +++ b/.github/workflows/integration_e2e_tests_inference_sdk_x86.yml @@ -45,16 +45,18 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-tests-inference-sdk-${{ matrix.python-version }}-integration-${{ hashFiles('requirements/**') }} - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true @@ -84,16 +86,18 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-tests-inference-sdk-${{ matrix.python-version }}-e2e-${{ hashFiles('requirements/**', 'workflows/pyproject.toml', 'workflows/uv.lock', 'inference_models/pyproject.toml') }} - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true diff --git a/.github/workflows/integration_tests_inference_cli_depending_on_inference_x86.yml b/.github/workflows/integration_tests_inference_cli_depending_on_inference_x86.yml index 939fcdf818..fc4d530b54 100644 --- a/.github/workflows/integration_tests_inference_cli_depending_on_inference_x86.yml +++ b/.github/workflows/integration_tests_inference_cli_depending_on_inference_x86.yml @@ -30,14 +30,16 @@ jobs: python-version: ["3.10"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-integration-tests-inference-cli-depending-on-inference-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/integration_tests_inference_cli_x86.yml b/.github/workflows/integration_tests_inference_cli_x86.yml index bacc755df0..b66a7f7b5c 100644 --- a/.github/workflows/integration_tests_inference_cli_x86.yml +++ b/.github/workflows/integration_tests_inference_cli_x86.yml @@ -30,14 +30,16 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-integration-tests-inference-cli-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/integration_tests_inference_experimental_cpu.yml b/.github/workflows/integration_tests_inference_experimental_cpu.yml index 208b155a9b..cfb41ae79c 100644 --- a/.github/workflows/integration_tests_inference_experimental_cpu.yml +++ b/.github/workflows/integration_tests_inference_experimental_cpu.yml @@ -4,8 +4,20 @@ permissions: on: pull_request: branches: [main] + paths-ignore: + - "docs/**" + - "theme/**" + - "theme_build/**" + - "mkdocs.yml" + - "**.md" push: branches: [main] + paths-ignore: + - "docs/**" + - "theme/**" + - "theme_build/**" + - "mkdocs.yml" + - "**.md" workflow_dispatch: inputs: extras: @@ -56,7 +68,9 @@ jobs: steps: - name: ๐Ÿ›Ž๏ธ Checkout if: ${{ (github.event.inputs.extras == '' || github.event.inputs.extras == matrix.extras.marker) && (github.event.inputs.python_version == '' || github.event.inputs.python_version == matrix.python-version) }} - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false # Restoring the full uv cache alongside model assets can exhaust runner disk. # Download dependencies per job and retain only the model-asset cache. - name: Check disk space before restoring model assets @@ -64,7 +78,7 @@ jobs: run: df -h . - name: ๐Ÿ“ฆ Cache test assets if: ${{ (github.event.inputs.extras == '' || github.event.inputs.extras == matrix.extras.marker) && (github.event.inputs.python_version == '' || github.event.inputs.python_version == matrix.python-version) }} - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: inference_models/tests/integration_tests/models/assets # Keyed per marker and shard (each downloads a different subset), not per Python version: assets are version-agnostic. @@ -80,7 +94,7 @@ jobs: fi - name: ๐Ÿ Set up Python ${{ matrix.python-version }} if: ${{ (github.event.inputs.extras == '' || github.event.inputs.extras == matrix.extras.marker) && (github.event.inputs.python_version == '' || github.event.inputs.python_version == matrix.python-version) }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true diff --git a/.github/workflows/integration_tests_inference_experimental_gpu.yml b/.github/workflows/integration_tests_inference_experimental_gpu.yml index dd1a1c6064..24c63b67c5 100644 --- a/.github/workflows/integration_tests_inference_experimental_gpu.yml +++ b/.github/workflows/integration_tests_inference_experimental_gpu.yml @@ -48,7 +48,7 @@ concurrency: jobs: integration-tests-inference-models-gpu: name: ${{ matrix.extras.marker }}:${{ matrix.python-version }}:cuda-graphs:${{ matrix.extras.enable_auto_cuda_graphs_for_trt }} - runs-on: Roboflow-GPU-VM-Runner + runs-on: arc-gpu-runner-set timeout-minutes: 30 strategy: matrix: @@ -62,10 +62,12 @@ jobs: steps: - name: ๐Ÿ›Ž๏ธ Checkout if: ${{ (inputs.extras == '' || inputs.extras == matrix.extras.marker) && (inputs.python_version == '' || inputs.python_version == matrix.python-version) }} - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages if: ${{ (inputs.extras == '' || inputs.extras == matrix.extras.marker) && (inputs.python_version == '' || inputs.python_version == matrix.python-version) }} - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/uv key: ${{ runner.os }}-uv-${{ matrix.python-version }}-${{ hashFiles('inference_models/pyproject.toml') }} @@ -73,7 +75,7 @@ jobs: ${{ runner.os }}-uv-${{ matrix.python-version }}- - name: ๐Ÿ“ฆ Cache apt packages if: ${{ (inputs.extras == '' || inputs.extras == matrix.extras.marker) && (inputs.python_version == '' || inputs.python_version == matrix.python-version) }} - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/apt-cache key: ${{ runner.os }}-apt-cuda-12-4 @@ -81,7 +83,7 @@ jobs: ${{ runner.os }}-apt-cuda- - name: ๐Ÿ Set up Python ${{ matrix.python-version }} if: ${{ (inputs.extras == '' || inputs.extras == matrix.extras.marker) && (inputs.python_version == '' || inputs.python_version == matrix.python-version) }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true diff --git a/.github/workflows/integration_tests_inference_models.yml b/.github/workflows/integration_tests_inference_models.yml index 9835680130..53f604185f 100644 --- a/.github/workflows/integration_tests_inference_models.yml +++ b/.github/workflows/integration_tests_inference_models.yml @@ -30,19 +30,21 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-integration-tests-inference-models-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} - name: ๐Ÿ“ฆ Cache test model packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: tests/inference/models_predictions_tests/assets/*.zip key: models-predictions-test-assets-${{ hashFiles('tests/inference/models_predictions_tests/conftest.py') }} diff --git a/.github/workflows/integration_tests_inference_server_x86.yml b/.github/workflows/integration_tests_inference_server_x86.yml index 60ea83160a..e82d068a19 100644 --- a/.github/workflows/integration_tests_inference_server_x86.yml +++ b/.github/workflows/integration_tests_inference_server_x86.yml @@ -95,7 +95,8 @@ jobs: && (github.event_name != 'push' || inputs.private_image) && (!inputs.private_image || github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch') }} runs-on: - group: group8core + labels: depot-ubuntu-22.04-8 + group: public-depot permissions: contents: read id-token: write @@ -129,14 +130,14 @@ jobs: run: python3 .github/scripts/ci_image.py - name: Set up Depot CLI if: ${{ inputs.private_image }} - uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Set up QEMU - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to Docker Hub if: ${{ !inputs.private_image }} - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} diff --git a/.github/workflows/integration_tests_workflows_tensor_native_x86.yml b/.github/workflows/integration_tests_workflows_tensor_native_x86.yml index 6f6e52aea7..fed1ea2986 100644 --- a/.github/workflows/integration_tests_workflows_tensor_native_x86.yml +++ b/.github/workflows/integration_tests_workflows_tensor_native_x86.yml @@ -54,14 +54,16 @@ jobs: timeout-minutes: 15 steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-integration-tests-workflows-tensor-native-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} @@ -74,7 +76,7 @@ jobs: pip install --extra-index-url https://download.pytorch.org/whl/cpu -r requirements/_requirements.txt -r requirements/requirements.sam.txt -r requirements/requirements.cpu.txt -r requirements/requirements.http.txt -r requirements/requirements.test.unit.txt -r requirements/requirements.doctr.txt -r requirements/requirements.yolo_world.txt -r requirements/requirements.transformers.txt -r requirements/requirements.sdk.http.txt -r requirements/requirements.easyocr.txt pip install --no-deps ./inference_models - name: ๐Ÿ”ค Cache Workflows font assets - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: workflows/roboflow_workflows/core_steps/visualizations/common/fonts/assets key: workflows-fonts-${{ hashFiles('workflows/roboflow_workflows/core_steps/visualizations/common/fonts/registry.py') }} diff --git a/.github/workflows/integration_tests_workflows_x86.yml b/.github/workflows/integration_tests_workflows_x86.yml index bf89a7fa1e..e784589f87 100644 --- a/.github/workflows/integration_tests_workflows_x86.yml +++ b/.github/workflows/integration_tests_workflows_x86.yml @@ -87,14 +87,16 @@ jobs: timeout-minutes: 25 steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-integration-tests-workflows-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} @@ -107,7 +109,7 @@ jobs: pip install --extra-index-url https://download.pytorch.org/whl/cpu -r requirements/_requirements.txt -r requirements/requirements.sam.txt -r requirements/requirements.cpu.txt -r requirements/requirements.http.txt -r requirements/requirements.test.unit.txt -r requirements/requirements.doctr.txt -r requirements/requirements.yolo_world.txt -r requirements/requirements.transformers.txt -r requirements/requirements.sdk.http.txt -r requirements/requirements.easyocr.txt pip install --no-deps './inference_models[torch-cpu,onnx-cpu]' - name: ๐Ÿ”ค Cache Workflows font assets - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: workflows/roboflow_workflows/core_steps/visualizations/common/fonts/assets key: workflows-fonts-${{ hashFiles('workflows/roboflow_workflows/core_steps/visualizations/common/fonts/registry.py') }} @@ -119,10 +121,18 @@ jobs: env: POSTGRESQL_TEST_DSN: "host=localhost port=5432 dbname=postgres user=postgres password=postgres-test-only sslmode=disable" KAFKA_TEST_BOOTSTRAP_SERVERS: "localhost:9092" - run: USE_INFERENCE_MODELS=${{ matrix.use-inference-models }} ROBOFLOW_API_KEY=${{ secrets.API_KEY }} DEEP_LAB_V3_API_KEY=${{ secrets.DEEP_LAB_V3_API_KEY }} MODAL_TOKEN_ID=${{ secrets.MODAL_TOKEN_ID }} MODAL_TOKEN_SECRET=${{ secrets.MODAL_TOKEN_SECRET }} MODAL_ALLOW_ANONYMOUS_EXECUTION=True MODAL_ANONYMOUS_WORKSPACE_NAME=github-test MODAL_SKIP_FLORENCE2_TEST=FALSE LOAD_ENTERPRISE_BLOCKS=TRUE python -m pytest tests/workflows/integration_tests --ignore=tests/workflows/integration_tests/execution/test_existing_blocks_modal_compatibility.py --ignore=tests/workflows/integration_tests/execution/test_workflow_with_custom_python_block_modal.py + USE_INFERENCE_MODELS: ${{ matrix.use-inference-models }} + ROBOFLOW_API_KEY: ${{ secrets.API_KEY }} + DEEP_LAB_V3_API_KEY: ${{ secrets.DEEP_LAB_V3_API_KEY }} + MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }} + MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }} + run: MODAL_ALLOW_ANONYMOUS_EXECUTION=True MODAL_ANONYMOUS_WORKSPACE_NAME=github-test MODAL_SKIP_FLORENCE2_TEST=FALSE LOAD_ENTERPRISE_BLOCKS=TRUE python -m pytest tests/workflows/integration_tests --ignore=tests/workflows/integration_tests/execution/test_existing_blocks_modal_compatibility.py --ignore=tests/workflows/integration_tests/execution/test_workflow_with_custom_python_block_modal.py - name: ๐Ÿงช Integration Tests of Workflows (Modal, staging) # This step does not read matrix.use-inference-models, so both legs ran the # same tests. Run it once per Python version, on the "true" leg unless a # manual dispatch selected only "false". if: ${{ matrix.use-inference-models == 'true' || inputs.use-inference-models == 'false' }} - run: PROJECT=roboflow-staging MODAL_TOKEN_ID=${{ secrets.MODAL_TOKEN_ID }} MODAL_TOKEN_SECRET=${{ secrets.MODAL_TOKEN_SECRET }} MODAL_ALLOW_ANONYMOUS_EXECUTION=True MODAL_ANONYMOUS_WORKSPACE_NAME=github-test python -m pytest tests/workflows/integration_tests/execution/test_existing_blocks_modal_compatibility.py tests/workflows/integration_tests/execution/test_workflow_with_custom_python_block_modal.py + env: + MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }} + MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }} + run: PROJECT=roboflow-staging MODAL_ALLOW_ANONYMOUS_EXECUTION=True MODAL_ANONYMOUS_WORKSPACE_NAME=github-test python -m pytest tests/workflows/integration_tests/execution/test_existing_blocks_modal_compatibility.py tests/workflows/integration_tests/execution/test_workflow_with_custom_python_block_modal.py diff --git a/.github/workflows/load_test_hosted_inference.yml b/.github/workflows/load_test_hosted_inference.yml index c3eb934344..03c253cbee 100644 --- a/.github/workflows/load_test_hosted_inference.yml +++ b/.github/workflows/load_test_hosted_inference.yml @@ -32,20 +32,22 @@ jobs: timeout-minutes: 30 steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python 3.12 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} restore-keys: | ${{ runner.os }}-pip-${{ matrix.python-version }}- - name: ๐Ÿ“ฆ Install JQ - uses: dcarbone/install-jq-action@v3.2.0 + uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0 - name: ๐Ÿ“ฆ Install dependencies required to run inference-cli run: | python -m pip install --upgrade pip diff --git a/.github/workflows/maintainer-review-slack.yml b/.github/workflows/maintainer-review-slack.yml index 48728511cc..c88d911bb1 100644 --- a/.github/workflows/maintainer-review-slack.yml +++ b/.github/workflows/maintainer-review-slack.yml @@ -25,6 +25,7 @@ jobs: startsWith(github.event.comment.body, '/maintainer-review ')) ) runs-on: ubuntu-latest + timeout-minutes: 10 permissions: contents: read pull-requests: read @@ -88,7 +89,7 @@ jobs: steps: # workflow_run and issue_comment execute on the default branch. Never # replace this with a checkout of the triggering PR or run's head SHA. - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.sha }} persist-credentials: false diff --git a/.github/workflows/modal.custom_python_block.deploy.yml b/.github/workflows/modal.custom_python_block.deploy.yml index d8df17f068..53e2df6e33 100644 --- a/.github/workflows/modal.custom_python_block.deploy.yml +++ b/.github/workflows/modal.custom_python_block.deploy.yml @@ -37,6 +37,7 @@ jobs: # `stage` picks the Roboflow project the deployed app talks to, per region. setup: runs-on: ubuntu-latest + timeout-minutes: 10 outputs: matrix: ${{ steps.gen.outputs.matrix }} steps: @@ -68,9 +69,11 @@ jobs: matrix: ${{ fromJSON(needs.setup.outputs.matrix) }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' - name: Install dependencies diff --git a/.github/workflows/probe_google_colab.yml b/.github/workflows/probe_google_colab.yml index 6170b8d93e..f6c8346df1 100644 --- a/.github/workflows/probe_google_colab.yml +++ b/.github/workflows/probe_google_colab.yml @@ -9,26 +9,29 @@ on: jobs: probe-google-colab-env: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: "read" id-token: "write" steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: GCP Account Setup - uses: "google-github-actions/auth@v3" + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: credentials_json: ${{ secrets.GOOGLE_COLAB_CI_RUNNER_SECRET }} - name: "Set up Cloud SDK" - uses: "google-github-actions/setup-gcloud@v3" + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 - name: ๐Ÿ“ฆ Install dependencies run: pip install -r development/google_colab_ci/requirements.txt diff --git a/.github/workflows/publish.pypi.inference_exp.yml b/.github/workflows/publish.pypi.inference_exp.yml index 9dd2034946..9314b967d8 100644 --- a/.github/workflows/publish.pypi.inference_exp.yml +++ b/.github/workflows/publish.pypi.inference_exp.yml @@ -26,9 +26,11 @@ jobs: python-version: ["3.12"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true @@ -43,7 +45,7 @@ jobs: python -m uv build - name: ๐Ÿš€ Publish to PyPI if: ${{ github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true') }} - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: packages-dir: inference_models/dist/ skip-existing: true diff --git a/.github/workflows/publish.pypi.inference_server_stack.yml b/.github/workflows/publish.pypi.inference_server_stack.yml index 718d3784e9..f6b38c2051 100644 --- a/.github/workflows/publish.pypi.inference_server_stack.yml +++ b/.github/workflows/publish.pypi.inference_server_stack.yml @@ -26,11 +26,14 @@ jobs: runs-on: labels: depot-ubuntu-22.04-small group: public-depot + timeout-minutes: 60 steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Set up uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2 - name: Assert matching versions run: | python - <<'EOF' @@ -150,7 +153,7 @@ jobs: mkdir -p /tmp/candidate/dists cp inference_model_manager/dist/* inference_server/dist/* /tmp/candidate/dists/ (cd /tmp/candidate/dists && shasum -a 256 * > ../SHA256SUMS) - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: public-wheels path: /tmp/candidate/ @@ -159,12 +162,13 @@ jobs: runs-on: labels: depot-ubuntu-22.04-small group: public-depot + timeout-minutes: 30 permissions: id-token: write contents: read actions: read steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: public-wheels path: /tmp/candidate @@ -172,6 +176,6 @@ jobs: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Verify candidate checksums run: cd /tmp/candidate/dists && shasum -a 256 -c ../SHA256SUMS - - uses: pypa/gh-action-pypi-publish@release/v1 + - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: packages-dir: /tmp/candidate/dists/ diff --git a/.github/workflows/publish.pypi.roboflow_workflows.yml b/.github/workflows/publish.pypi.roboflow_workflows.yml index f425caadf7..f43750b05e 100644 --- a/.github/workflows/publish.pypi.roboflow_workflows.yml +++ b/.github/workflows/publish.pypi.roboflow_workflows.yml @@ -24,15 +24,17 @@ jobs: timeout-minutes: 10 steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python 3.12 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: ๐Ÿ›ž Build roboflow-workflows wheel run: make create_workflows_wheel - name: ๐Ÿ“ค Upload built wheel as artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: roboflow-workflows-wheel path: dist/roboflow_workflows-*.whl @@ -41,7 +43,7 @@ jobs: # only when the operator explicitly opts in โ€” default is build-only # so smoke-testing the packaging never accidentally re-tags PyPI. if: ${{ github.event_name == 'release' || github.event.inputs.publish == 'true' }} - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: packages-dir: dist/ skip-existing: true diff --git a/.github/workflows/publish.pypi.streamvision.yml b/.github/workflows/publish.pypi.streamvision.yml index 8f1df485c1..9287bfc5a6 100644 --- a/.github/workflows/publish.pypi.streamvision.yml +++ b/.github/workflows/publish.pypi.streamvision.yml @@ -24,9 +24,11 @@ jobs: timeout-minutes: 10 steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python 3.12 - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: ๐Ÿ›ž Build streamvision wheel @@ -39,7 +41,7 @@ jobs: test "$(ls dist | wc -l)" -eq 1 unzip -l dist/streamvision-*.whl | grep -qE ' streamvision/.+\.py$' - name: ๐Ÿ“ค Upload built wheel as artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: streamvision-wheel path: dist/streamvision-*.whl @@ -48,7 +50,7 @@ jobs: # only when the operator explicitly opts in โ€” default is build-only # so smoke-testing the packaging never accidentally re-tags PyPI. if: ${{ github.event_name == 'release' || github.event.inputs.publish == 'true' }} - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: packages-dir: dist/ skip-existing: true diff --git a/.github/workflows/publish.pypi.yml b/.github/workflows/publish.pypi.yml index 0ba4d12148..83a9e32f03 100644 --- a/.github/workflows/publish.pypi.yml +++ b/.github/workflows/publish.pypi.yml @@ -19,18 +19,13 @@ jobs: python-version: ["3.12"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} - - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 - with: - path: ~/.cache/pip - key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} - restore-keys: | - ${{ runner.os }}-pip-${{ matrix.python-version }}- - name: ๐Ÿ›ž Create Wheels run: | make create_wheels @@ -40,4 +35,4 @@ jobs: # racing skip-existing checks on the same tag. run: rm -f dist/roboflow_workflows-*.whl dist/roboflow_workflows-*.tar.gz dist/inference_models-*.whl dist/streamvision-*.whl dist/streamvision-*.tar.gz - name: ๐Ÿš€ Publish to PyPi - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 diff --git a/.github/workflows/static_code_analysis.yml b/.github/workflows/static_code_analysis.yml index a11bccd411..b2eea122c5 100644 --- a/.github/workflows/static_code_analysis.yml +++ b/.github/workflows/static_code_analysis.yml @@ -26,7 +26,9 @@ jobs: timeout-minutes: 15 steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: Install code analysis dependencies run: | python -m pip install --upgrade pip diff --git a/.github/workflows/test.colab.cpu.yml b/.github/workflows/test.colab.cpu.yml index 1eb693fa37..1d53d57528 100644 --- a/.github/workflows/test.colab.cpu.yml +++ b/.github/workflows/test.colab.cpu.yml @@ -18,19 +18,22 @@ jobs: build: if: ${{ !github.event.act }} runs-on: - group: group8core + labels: depot-ubuntu-22.04-8 + group: public-depot timeout-minutes: 35 steps: - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: - ref: ${{ github.head_ref }} + persist-credentials: false - name: ๐Ÿ”จ Build Docker run: docker build -t inference-google-colab:cpu -f ./docker/dockerfiles/Dockerfile.google.colab.cpu . - name: ๐Ÿงช Run tests - run: docker run -e ROBOFLOW_API_KEY=${{ secrets.API_KEY }} inference-google-colab:cpu + env: + ROBOFLOW_API_KEY: ${{ secrets.API_KEY }} + run: docker run -e ROBOFLOW_API_KEY inference-google-colab:cpu diff --git a/.github/workflows/test.colab.gpu.yml b/.github/workflows/test.colab.gpu.yml index f7a05cf62f..9aa26845de 100644 --- a/.github/workflows/test.colab.gpu.yml +++ b/.github/workflows/test.colab.gpu.yml @@ -17,19 +17,21 @@ concurrency: jobs: build: if: ${{ !github.event.act }} - runs-on: Roboflow-GPU-VM-Runner + runs-on: arc-gpu-runner-set timeout-minutes: 45 steps: - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: - ref: ${{ github.head_ref }} + persist-credentials: false - name: ๐Ÿ”จ Build Docker run: docker build -t inference-google-colab:gpu -f ./docker/dockerfiles/Dockerfile.google.colab.gpu . - name: ๐Ÿงช Run tests - run: docker run -e ROBOFLOW_API_KEY=${{ secrets.API_KEY }} --runtime nvidia inference-google-colab:gpu + env: + ROBOFLOW_API_KEY: ${{ secrets.API_KEY }} + run: docker run -e ROBOFLOW_API_KEY --runtime nvidia inference-google-colab:gpu diff --git a/.github/workflows/test.jetson_4.6.1.yml b/.github/workflows/test.jetson_4.6.1.yml index 7c62f33029..a06d9d12c5 100644 --- a/.github/workflows/test.jetson_4.6.1.yml +++ b/.github/workflows/test.jetson_4.6.1.yml @@ -11,18 +11,20 @@ jobs: steps: - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/test.jetson_5.1.1.yml b/.github/workflows/test.jetson_5.1.1.yml index d12426b5b9..238cfda904 100644 --- a/.github/workflows/test.jetson_5.1.1.yml +++ b/.github/workflows/test.jetson_5.1.1.yml @@ -11,18 +11,20 @@ jobs: steps: - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/test.jetson_6.0.0.yml b/.github/workflows/test.jetson_6.0.0.yml index 6231611379..1b2aa3e040 100644 --- a/.github/workflows/test.jetson_6.0.0.yml +++ b/.github/workflows/test.jetson_6.0.0.yml @@ -11,18 +11,20 @@ jobs: steps: - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/test.nvidia_t4.yml b/.github/workflows/test.nvidia_t4.yml index df32c45331..6940f57e6a 100644 --- a/.github/workflows/test.nvidia_t4.yml +++ b/.github/workflows/test.nvidia_t4.yml @@ -114,7 +114,7 @@ jobs: && !github.event.act && (github.event_name != 'push' || inputs.private_image) && (!inputs.private_image || github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch') }} - runs-on: Roboflow-GPU-VM-Runner + runs-on: arc-gpu-runner-set permissions: contents: read id-token: write @@ -148,11 +148,11 @@ jobs: run: python3 .github/scripts/ci_image.py - name: Set up Depot CLI if: ${{ inputs.private_image }} - uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1 + uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2 - name: Set up QEMU - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: ๐Ÿฆพ Install dependencies run: | python3 -m venv .venv diff --git a/.github/workflows/test.nvidia_t4_parallel_server.yml b/.github/workflows/test.nvidia_t4_parallel_server.yml index b32477ea3d..d2c2035a9a 100644 --- a/.github/workflows/test.nvidia_t4_parallel_server.yml +++ b/.github/workflows/test.nvidia_t4_parallel_server.yml @@ -27,19 +27,21 @@ concurrency: jobs: build: if: ${{ !github.event.act }} - runs-on: Roboflow-GPU-VM-Runner + runs-on: arc-gpu-runner-set timeout-minutes: 60 steps: - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} @@ -62,9 +64,19 @@ jobs: - name: ๐Ÿงช Regression Tests without Torch Preprocessing - Parallel GPU id: regression_tests_with_python_preprocessing if: ${{ github.event.inputs.test_name == '' || github.event.inputs.test_name == 'regression_without_torch' }} + env: + API_KEY: ${{ secrets.API_KEY }} + asl_instance_segmentation_API_KEY: ${{ secrets.ASL_INSTANCE_SEGMENTATION_API_KEY }} + asl_poly_instance_seg_API_KEY: ${{ secrets.ASL_POLY_INSTANCE_SEG_API_KEY }} + bccd_favz3_API_KEY: ${{ secrets.BCCD_FAVZ3_API_KEY }} + bccd_i4nym_API_KEY: ${{ secrets.BCCD_I4NYM_API_KEY }} + cats_and_dogs_smnpl_API_KEY: ${{ secrets.CATS_AND_DOGS_SMNPL_API_KEY }} + coins_xaz9i_API_KEY: ${{ secrets.COINS_XAZ9I_API_KEY }} + melee_API_KEY: ${{ secrets.MELEE_API_KEY }} + yolonas_test_API_KEY: ${{ secrets.YOLONAS_TEST_API_KEY }} run: | source venv/bin/activate - IS_PARALLEL_SERVER=true SKIP_VISUALISATION_TESTS=true FUNCTIONAL=true PORT=9101 API_KEY=${{ secrets.API_KEY }} asl_instance_segmentation_API_KEY=${{ secrets.ASL_INSTANCE_SEGMENTATION_API_KEY }} asl_poly_instance_seg_API_KEY=${{ secrets.ASL_POLY_INSTANCE_SEG_API_KEY }} bccd_favz3_API_KEY=${{ secrets.BCCD_FAVZ3_API_KEY }} bccd_i4nym_API_KEY=${{ secrets.BCCD_I4NYM_API_KEY }} cats_and_dogs_smnpl_API_KEY=${{ secrets.CATS_AND_DOGS_SMNPL_API_KEY }} coins_xaz9i_API_KEY=${{ secrets.COINS_XAZ9I_API_KEY }} melee_API_KEY=${{ secrets.MELEE_API_KEY }} yolonas_test_API_KEY=${{ secrets.YOLONAS_TEST_API_KEY }} python3 -m pytest tests/inference/integration_tests/regression_test.py tests/inference/integration_tests/batch_regression_test.py + IS_PARALLEL_SERVER=true SKIP_VISUALISATION_TESTS=true FUNCTIONAL=true PORT=9101 python3 -m pytest tests/inference/integration_tests/regression_test.py tests/inference/integration_tests/batch_regression_test.py - name: ๐Ÿšจ Show server logs on error if: ${{ github.event.inputs.test_name == '' || github.event.inputs.test_name == 'regression_without_torch' || failure() }} run: docker logs inference-test @@ -79,9 +91,19 @@ jobs: - name: ๐Ÿงช Regression Tests with Torch Preprocessing - Parallel GPU id: regression_tests_without_python_preprocessing if: ${{ github.event.inputs.test_name == '' || github.event.inputs.test_name == 'regression_with_torch' }} + env: + API_KEY: ${{ secrets.API_KEY }} + asl_instance_segmentation_API_KEY: ${{ secrets.ASL_INSTANCE_SEGMENTATION_API_KEY }} + asl_poly_instance_seg_API_KEY: ${{ secrets.ASL_POLY_INSTANCE_SEG_API_KEY }} + bccd_favz3_API_KEY: ${{ secrets.BCCD_FAVZ3_API_KEY }} + bccd_i4nym_API_KEY: ${{ secrets.BCCD_I4NYM_API_KEY }} + cats_and_dogs_smnpl_API_KEY: ${{ secrets.CATS_AND_DOGS_SMNPL_API_KEY }} + coins_xaz9i_API_KEY: ${{ secrets.COINS_XAZ9I_API_KEY }} + melee_API_KEY: ${{ secrets.MELEE_API_KEY }} + yolonas_test_API_KEY: ${{ secrets.YOLONAS_TEST_API_KEY }} run: | source venv/bin/activate - IS_PARALLEL_SERVER=true SKIP_VISUALISATION_TESTS=true FUNCTIONAL=true PORT=9101 API_KEY=${{ secrets.API_KEY }} asl_instance_segmentation_API_KEY=${{ secrets.ASL_INSTANCE_SEGMENTATION_API_KEY }} asl_poly_instance_seg_API_KEY=${{ secrets.ASL_POLY_INSTANCE_SEG_API_KEY }} bccd_favz3_API_KEY=${{ secrets.BCCD_FAVZ3_API_KEY }} bccd_i4nym_API_KEY=${{ secrets.BCCD_I4NYM_API_KEY }} cats_and_dogs_smnpl_API_KEY=${{ secrets.CATS_AND_DOGS_SMNPL_API_KEY }} coins_xaz9i_API_KEY=${{ secrets.COINS_XAZ9I_API_KEY }} melee_API_KEY=${{ secrets.MELEE_API_KEY }} yolonas_test_API_KEY=${{ secrets.YOLONAS_TEST_API_KEY }} python3 -m pytest tests/inference/integration_tests/regression_test.py tests/inference/integration_tests/batch_regression_test.py + IS_PARALLEL_SERVER=true SKIP_VISUALISATION_TESTS=true FUNCTIONAL=true PORT=9101 python3 -m pytest tests/inference/integration_tests/regression_test.py tests/inference/integration_tests/batch_regression_test.py - name: ๐Ÿšจ Show server logs on error if: ${{ github.event.inputs.test_name == '' || github.event.inputs.test_name == 'regression_with_torch' || failure() }} run: docker logs inference-test diff --git a/.github/workflows/test_package_install_inference.yml b/.github/workflows/test_package_install_inference.yml index abee437741..feb4b78d47 100644 --- a/.github/workflows/test_package_install_inference.yml +++ b/.github/workflows/test_package_install_inference.yml @@ -6,7 +6,6 @@ on: workflow_dispatch: permissions: - id-token: write contents: read concurrency: @@ -33,20 +32,22 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python 3.10 to create wheels - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.10" - name: ๐Ÿ›ž Create Wheels run: | make create_wheels - name: ๐Ÿ Set up Python ${{ matrix.python-version }} to test package install process - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-package-install-inference-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/test_package_install_inference_cli.yml b/.github/workflows/test_package_install_inference_cli.yml index 87698f55d1..2e25059820 100644 --- a/.github/workflows/test_package_install_inference_cli.yml +++ b/.github/workflows/test_package_install_inference_cli.yml @@ -6,7 +6,6 @@ on: workflow_dispatch: permissions: - id-token: write contents: read concurrency: @@ -33,20 +32,22 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python 3.10 to create wheels - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.10" - name: ๐Ÿ›ž Create Wheels run: | make create_inference_cli_whl - name: ๐Ÿ Set up Python ${{ matrix.python-version }} to test package install process - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-package-install-inference-cli-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/test_package_install_inference_gpu.yml b/.github/workflows/test_package_install_inference_gpu.yml index 36af0e7e85..373fffaee0 100644 --- a/.github/workflows/test_package_install_inference_gpu.yml +++ b/.github/workflows/test_package_install_inference_gpu.yml @@ -6,7 +6,6 @@ on: workflow_dispatch: permissions: - id-token: write contents: read concurrency: @@ -24,27 +23,29 @@ jobs: build: needs: call_is_mergeable if: ${{ github.event_name != 'pull_request' || needs.call_is_mergeable.outputs.mergeable_state != 'not_clean' }} - runs-on: Roboflow-GPU-VM-Runner + runs-on: arc-gpu-runner-set timeout-minutes: 15 strategy: matrix: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python 3.10 to create wheels - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.10" - name: ๐Ÿ›ž Create Wheels run: | make create_wheels - name: ๐Ÿ Set up Python ${{ matrix.python-version }} to test package install process - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/test_package_install_inference_gpu_with_extras.yml b/.github/workflows/test_package_install_inference_gpu_with_extras.yml index bd374fc13a..d6525a774f 100644 --- a/.github/workflows/test_package_install_inference_gpu_with_extras.yml +++ b/.github/workflows/test_package_install_inference_gpu_with_extras.yml @@ -6,7 +6,6 @@ on: workflow_dispatch: permissions: - id-token: write contents: read concurrency: @@ -24,16 +23,18 @@ jobs: build: needs: call_is_mergeable if: ${{ github.event_name != 'pull_request' || needs.call_is_mergeable.outputs.mergeable_state != 'not_clean' }} - runs-on: Roboflow-GPU-VM-Runner + runs-on: arc-gpu-runner-set timeout-minutes: 30 strategy: matrix: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python 3.10 to create wheels - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.10" - name: ๐Ÿšง Install GDAL OS library @@ -42,11 +43,11 @@ jobs: run: | make create_wheels - name: ๐Ÿ Set up Python ${{ matrix.python-version }} to test package install process - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/test_package_install_inference_sdk.yml b/.github/workflows/test_package_install_inference_sdk.yml index fbcd94962f..4165d1d692 100644 --- a/.github/workflows/test_package_install_inference_sdk.yml +++ b/.github/workflows/test_package_install_inference_sdk.yml @@ -6,7 +6,6 @@ on: workflow_dispatch: permissions: - id-token: write contents: read concurrency: @@ -33,20 +32,22 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python 3.10 to create wheels - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.10" - name: ๐Ÿ›ž Create Wheels run: | make create_inference_cli_whl - name: ๐Ÿ Set up Python ${{ matrix.python-version }} to test package install process - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-package-install-inference-sdk-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/test_package_install_inference_with_extras.yml b/.github/workflows/test_package_install_inference_with_extras.yml index b4c9018939..d2ddfee8c7 100644 --- a/.github/workflows/test_package_install_inference_with_extras.yml +++ b/.github/workflows/test_package_install_inference_with_extras.yml @@ -6,7 +6,6 @@ on: workflow_dispatch: permissions: - id-token: write contents: read concurrency: @@ -33,9 +32,11 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python 3.10 to create wheels - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.10" - name: ๐Ÿšง Install GDAL OS library @@ -44,11 +45,11 @@ jobs: run: | make create_wheels - name: ๐Ÿ Set up Python ${{ matrix.python-version }} to test package install process - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-package-install-inference-with-extras-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} diff --git a/.github/workflows/unit_tests_inference_cli_x86.yml b/.github/workflows/unit_tests_inference_cli_x86.yml index 89275792d7..f6de145659 100644 --- a/.github/workflows/unit_tests_inference_cli_x86.yml +++ b/.github/workflows/unit_tests_inference_cli_x86.yml @@ -44,14 +44,16 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-unit-tests-inference-cli-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true diff --git a/.github/workflows/unit_tests_inference_experimental.yml b/.github/workflows/unit_tests_inference_experimental.yml index fecf04429e..aa7aa96eaa 100644 --- a/.github/workflows/unit_tests_inference_experimental.yml +++ b/.github/workflows/unit_tests_inference_experimental.yml @@ -39,9 +39,11 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true diff --git a/.github/workflows/unit_tests_inference_experimental_gpu.yml b/.github/workflows/unit_tests_inference_experimental_gpu.yml index 3d5064eaaa..a1b1203afc 100644 --- a/.github/workflows/unit_tests_inference_experimental_gpu.yml +++ b/.github/workflows/unit_tests_inference_experimental_gpu.yml @@ -19,27 +19,29 @@ concurrency: jobs: unit-tests-inference-models-gpu: name: trt_extras:3.12 - runs-on: Roboflow-GPU-VM-Runner + runs-on: arc-gpu-runner-set timeout-minutes: 15 steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/uv key: ${{ runner.os }}-uv-3.12-${{ hashFiles('inference_models/pyproject.toml') }} restore-keys: | ${{ runner.os }}-uv-3.12- - name: ๐Ÿ“ฆ Cache apt packages - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/apt-cache key: ${{ runner.os }}-apt-cuda-12-4 restore-keys: | ${{ runner.os }}-apt-cuda- - name: ๐Ÿ Set up Python 3.12 - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' check-latest: true diff --git a/.github/workflows/unit_tests_inference_model_manager_and_server.yml b/.github/workflows/unit_tests_inference_model_manager_and_server.yml index 831e1ff20c..2f4ae918cb 100644 --- a/.github/workflows/unit_tests_inference_model_manager_and_server.yml +++ b/.github/workflows/unit_tests_inference_model_manager_and_server.yml @@ -47,19 +47,21 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“… Cache week id: cache-week run: echo "week=$(date -u +%G-W%V)" >> "$GITHUB_OUTPUT" - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/uv key: ${{ steps.cache-week.outputs.week }}-${{ runner.os }}-uv-${{ matrix.python-version }}-${{ hashFiles('inference_models/pyproject.toml', 'inference_model_manager/pyproject.toml', 'inference_server/pyproject.toml', 'workflows/pyproject.toml', 'stream_vision/pyproject.toml') }} restore-keys: | ${{ steps.cache-week.outputs.week }}-${{ runner.os }}-uv-${{ matrix.python-version }}- - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true diff --git a/.github/workflows/unit_tests_inference_sdk_x86.yml b/.github/workflows/unit_tests_inference_sdk_x86.yml index 67e41d3183..c2830fbb15 100644 --- a/.github/workflows/unit_tests_inference_sdk_x86.yml +++ b/.github/workflows/unit_tests_inference_sdk_x86.yml @@ -44,14 +44,16 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-unit-tests-inference-sdk-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true diff --git a/.github/workflows/unit_tests_inference_x86.yml b/.github/workflows/unit_tests_inference_x86.yml index 9778c7c3f2..bace390de8 100644 --- a/.github/workflows/unit_tests_inference_x86.yml +++ b/.github/workflows/unit_tests_inference_x86.yml @@ -39,9 +39,11 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip # Workflow-specific key: many workflows install different package sets under @@ -49,7 +51,7 @@ jobs: # set was saved first. No restore-keys, so the cache cannot grow without bound. key: ${{ runner.os }}-pip-unit-tests-inference-${{ matrix.python-version }}-${{ hashFiles('requirements/**') }} - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true diff --git a/.github/workflows/unit_tests_streamvision_x86.yml b/.github/workflows/unit_tests_streamvision_x86.yml index 183f6afd0f..d9caaf3590 100644 --- a/.github/workflows/unit_tests_streamvision_x86.yml +++ b/.github/workflows/unit_tests_streamvision_x86.yml @@ -19,6 +19,7 @@ jobs: secrets: inherit changes: runs-on: ubuntu-latest + timeout-minutes: 10 permissions: pull-requests: read outputs: @@ -60,8 +61,10 @@ jobs: matrix: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} cache: pip @@ -94,6 +97,7 @@ jobs: needs: [changes, package-tests] if: ${{ always() }} runs-on: ubuntu-latest + timeout-minutes: 30 steps: - name: Report result env: diff --git a/.github/workflows/unit_tests_workflows_tensor_native_x86.yml b/.github/workflows/unit_tests_workflows_tensor_native_x86.yml index 862628b051..a0d0377e10 100644 --- a/.github/workflows/unit_tests_workflows_tensor_native_x86.yml +++ b/.github/workflows/unit_tests_workflows_tensor_native_x86.yml @@ -41,19 +41,21 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-unit-tests-workflows-tensor-native-${{ matrix.python-version }}-${{ hashFiles('requirements/**', 'workflows/pyproject.toml', 'workflows/uv.lock') }} - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true - name: ๐Ÿ”ค Cache Workflows font assets - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: workflows/roboflow_workflows/core_steps/visualizations/common/fonts/assets key: workflows-fonts-${{ hashFiles('workflows/roboflow_workflows/core_steps/visualizations/common/fonts/registry.py') }} @@ -88,8 +90,10 @@ jobs: PIP_EXTRA_INDEX_URL: https://download.pytorch.org/whl/cpu PIP_CONSTRAINT: ${{ github.workspace }}/workflows/tests/isolation/constraints-cpu.txt steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} cache: pip diff --git a/.github/workflows/unit_tests_workflows_x86.yml b/.github/workflows/unit_tests_workflows_x86.yml index 14c00dc7e7..08c5943d37 100644 --- a/.github/workflows/unit_tests_workflows_x86.yml +++ b/.github/workflows/unit_tests_workflows_x86.yml @@ -41,19 +41,21 @@ jobs: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - name: ๐Ÿ›Ž๏ธ Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false - name: ๐Ÿ“ฆ Cache Python packages - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-unit-tests-workflows-${{ matrix.python-version }}-${{ hashFiles('requirements/**', 'workflows/pyproject.toml', 'workflows/uv.lock') }} - name: ๐Ÿ Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} check-latest: true - name: ๐Ÿ”ค Cache Workflows font assets - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: workflows/roboflow_workflows/core_steps/visualizations/common/fonts/assets key: workflows-fonts-${{ hashFiles('workflows/roboflow_workflows/core_steps/visualizations/common/fonts/registry.py') }} @@ -86,8 +88,10 @@ jobs: PIP_EXTRA_INDEX_URL: https://download.pytorch.org/whl/cpu PIP_CONSTRAINT: ${{ github.workspace }}/workflows/tests/isolation/constraints-cpu.txt steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} cache: pip diff --git a/.github/workflows/validate.github-actions.yml b/.github/workflows/validate.github-actions.yml index 794cf34b1f..f9119e430f 100644 --- a/.github/workflows/validate.github-actions.yml +++ b/.github/workflows/validate.github-actions.yml @@ -32,8 +32,11 @@ jobs: actionlint: name: Lint every workflow runs-on: depot-ubuntu-24.04 + timeout-minutes: 20 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false # Running without file arguments makes actionlint discover and lint every # workflow under .github/workflows, not only the workflow that changed. @@ -47,7 +50,7 @@ jobs: # Every pull_request/push-triggered workflow must carry the shared # concurrency block (see the `concurrency:` comment in any workflow), and # workflow names must be unique because github.workflow is the group key. - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 diff --git a/CLAUDE.md b/CLAUDE.md index f5914c5c8f..78ac9d530e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -3,3 +3,25 @@ Follow the shared repository guidance: @AGENTS.md + +## GitHub Actions + +- Pin every action to a full commit SHA with an exact `# vX.Y.Z` comment; + Dependabot keeps the pins current. +- Standard GitHub-hosted runners are free on this public repository; keep + `ubuntu-latest`, macOS and Windows jobs there. Paid CPU jobs use Depot + (`depot-ubuntu-22.04-*` or `depot-ubuntu-24.04-*` with `group: public-depot`), + never GitHub larger runners. +- GPU jobs use `arc-gpu-runner-set`. Those runners are self-hosted: trigger GPU + workflows only on `push`, `workflow_dispatch` or `workflow_call` from such a + workflow, never on fork pull requests. Runner pods are ephemeral, so nothing + persists on the runner between jobs. +- Every job sets `timeout-minutes`; a hung job otherwise bills six hours. +- Set `persist-credentials: false` on `actions/checkout` unless a later step + pushes. +- Pass secrets and event data to `run:` through `env:`, never by interpolating + `${{ }}` into the script. +- Grant `id-token: write` and other write permissions per job, only where used. +- Do not restore dependency caches in release or publish workflows. +- Validate workflow changes with `actionlint` (see `.github/actionlint.yaml`) + and `uvx zizmor .github/workflows`. From 8ea750d0feeb9f04611a891458db5f93c7ec8975 Mon Sep 17 00:00:00 2001 From: Alex Norell Date: Fri, 30 Oct 2026 18:08:52 -0700 Subject: [PATCH 2/3] Keep Windows readiness banner compatible with redirected consoles --- app_bundles/windows/run_inference.py | 4 +- .../unit_tests/test_windows_startup_banner.py | 47 +++++++++++++++++++ 2 files changed, 49 insertions(+), 2 deletions(-) create mode 100644 tests/inference/unit_tests/test_windows_startup_banner.py diff --git a/app_bundles/windows/run_inference.py b/app_bundles/windows/run_inference.py index e6b31f22a2..44787e9291 100644 --- a/app_bundles/windows/run_inference.py +++ b/app_bundles/windows/run_inference.py @@ -220,12 +220,12 @@ def _remove_console_handlers(logger_name: str): _remove_console_handlers(name) banner = ( "\n\n\n\n\n\n\n\n\n" - "โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ \n" + "----------------------------------------------------------- \n" " \n" " Roboflow Inference is ready \n" f" Dashboard: {url:<44} (since IPv6 is attempted first when making requests, please use this address instead of localhost)\n" " \n" - "โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€\n" + "-----------------------------------------------------------\n" ) print(banner, flush=True) await serve_task diff --git a/tests/inference/unit_tests/test_windows_startup_banner.py b/tests/inference/unit_tests/test_windows_startup_banner.py new file mode 100644 index 0000000000..ad83f51829 --- /dev/null +++ b/tests/inference/unit_tests/test_windows_startup_banner.py @@ -0,0 +1,47 @@ +"""The frozen Windows server must survive a strict redirected console.""" + +import ast +import asyncio +import io +import logging +from contextlib import redirect_stdout +from pathlib import Path +from types import SimpleNamespace + + +def test_startup_banner_keeps_server_running_on_cp1252_console(): + source = Path(__file__).resolve().parents[3] / "app_bundles/windows/run_inference.py" + function = next( + node for node in ast.walk(ast.parse(source.read_text())) + if isinstance(node, ast.AsyncFunctionDef) and node.name == "_serve_with_banner" + ) + served = [] + + class Server: + def __init__(self, config): + self.started = self + + async def wait(self): + pass + + async def serve(self): + served.append(True) + + logger = SimpleNamespace(handlers=[], addFilter=lambda value: None) + namespace = { + "asyncio": asyncio, + "os": SimpleNamespace(environ={"HOST": "127.0.0.1"}), + "app": object(), + "logging": SimpleNamespace(getLogger=lambda name: logger, StreamHandler=logging.StreamHandler), + "FilteredAccessLogConfig": lambda: object(), + "uvicorn": SimpleNamespace(Config=lambda *args, **kwargs: kwargs, Server=Server), + } + exec(compile(ast.Module(body=[function], type_ignores=[]), str(source), "exec"), namespace) + output = io.BytesIO() + console = io.TextIOWrapper(output, encoding="cp1252", errors="strict") + with redirect_stdout(console): + asyncio.run(namespace["_serve_with_banner"]()) + console.flush() + assert b"Roboflow Inference is ready" in output.getvalue() + assert b"http://127.0.0.1:9001/" in output.getvalue() + assert served == [True] From 7bc7848530c63e77908185a77e9674855c6ae46c Mon Sep 17 00:00:00 2001 From: Alex Norell Date: Fri, 30 Oct 2026 18:11:43 -0700 Subject: [PATCH 3/3] Format Windows console regression test --- .../unit_tests/test_windows_startup_banner.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/tests/inference/unit_tests/test_windows_startup_banner.py b/tests/inference/unit_tests/test_windows_startup_banner.py index ad83f51829..60407f6912 100644 --- a/tests/inference/unit_tests/test_windows_startup_banner.py +++ b/tests/inference/unit_tests/test_windows_startup_banner.py @@ -12,7 +12,8 @@ def test_startup_banner_keeps_server_running_on_cp1252_console(): source = Path(__file__).resolve().parents[3] / "app_bundles/windows/run_inference.py" function = next( - node for node in ast.walk(ast.parse(source.read_text())) + node + for node in ast.walk(ast.parse(source.read_text())) if isinstance(node, ast.AsyncFunctionDef) and node.name == "_serve_with_banner" ) served = [] @@ -32,11 +33,16 @@ async def serve(self): "asyncio": asyncio, "os": SimpleNamespace(environ={"HOST": "127.0.0.1"}), "app": object(), - "logging": SimpleNamespace(getLogger=lambda name: logger, StreamHandler=logging.StreamHandler), + "logging": SimpleNamespace( + getLogger=lambda name: logger, StreamHandler=logging.StreamHandler + ), "FilteredAccessLogConfig": lambda: object(), "uvicorn": SimpleNamespace(Config=lambda *args, **kwargs: kwargs, Server=Server), } - exec(compile(ast.Module(body=[function], type_ignores=[]), str(source), "exec"), namespace) + exec( + compile(ast.Module(body=[function], type_ignores=[]), str(source), "exec"), + namespace, + ) output = io.BytesIO() console = io.TextIOWrapper(output, encoding="cp1252", errors="strict") with redirect_stdout(console):