Merge pull request #542 from carlewis/dependency-pinning

Dependency pinning

.github/actions/build_portBLAS_action/action.yml

@@ -49,4 +49,4 @@ runs:
       uses: actions/upload-artifact@v4
       with:
         name: portBLAS_build
-        path: portBLAS_build.tar.gz
+        path: portBLAS_build.tar.gz

.github/actions/build_portDNN_action/action.yml

@@ -50,4 +50,4 @@ runs:
       uses: actions/upload-artifact@v4
       with:
         name: portDNN_build
-        path: portDNN_build.tar.gz
+        path: portDNN_build.tar.gz

.github/actions/setup_ubuntu_build/action.yml

@@ -23,7 +23,7 @@ runs:
   using: "composite"
   steps:
     - name: Install prerequisites
-      shell: bash    
+      shell: bash
       run: |
         sudo apt-get install -y spirv-tools
         pip install lit
@@ -32,18 +32,17 @@ runs:
       uses: llvm/actions/install-ninja@main
 
     - name: load llvm
-      uses: actions/cache/restore@v3
+      uses: actions/cache/restore@v4
       with:
         path: llvm_install/**
         key: llvm-ubuntu-${{ inputs.ubuntu_version }}-${{ inputs.arch }}-v${{ inputs.llvm_version}}-${{ inputs.llvm_build_type }}
         fail-on-cache-miss: true
 
       # note the PR testing usage should set 'save' to false, to avoid PR testing creating new caches on a branch
     - name: Setup sccache
-      uses: hendrikmuhs/[email protected]
+      uses: hendrikmuhs/ccache-action@ed74d11c0b343532753ecead8a951bb09bb34bc9 # v1.2.14
       with:
         max-size: 200M
         key: sccache-build
         variant: sccache
         save: ${{ inputs.save }}
-

.github/dependabot.yml

@@ -3,7 +3,12 @@ version: 2
 updates:
 # Enable version updates for Github Actions
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/build_portBLAS_action"
+      - "/.github/actions/build_portDNN_action"
+      - "/.github/actions/build_vgg_resnet_action"
+      - "/.github/actions/setup_ubuntu_build"
     schedule:
       interval: "monthly"
     groups:

.github/workflows/build_pr_cache.yml

@@ -7,15 +7,15 @@ on:
   # pull_request:
   #   paths:
   #     - '.github/workflows/build_pr_cache.yml'
-  #     - '.github/do_build_ock/**'  
+  #     - '.github/do_build_ock/**'
   push:
     branches:
       - main
     paths:
       - '.github/workflows/build_pr_cache.yml'
       - '.github/actions/do_build_ock/**'
       - '.github/actions/setup_ubuntu_build/**'
-  
+
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
@@ -29,7 +29,7 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
-      
+
       # installs tools, ninja and installs llvm (default 17, RelAssert) and sets up cache
       - name: setup-ubuntu
         uses:  ./.github/actions/setup_ubuntu_build
@@ -52,10 +52,10 @@ jobs:
           build_dir: build_offline
           assemble_spirv_ll_lit_test_offline: ON
           build_targets:
-   
+
       - name: clean_build
         run:
           rm -rf ${{ github.workspace }}/build*
 
       - name: build riscv m1
-        uses: ./.github/actions/do_build_ock/do_build_m1  
+        uses: ./.github/actions/do_build_ock/do_build_m1

.github/workflows/create_llvm.yml

@@ -8,7 +8,7 @@ on:
       - '.github/workflows/create_llvm.yml'
   pull_request:
     paths:
-      - '.github/workflows/create_llvm.yml'         
+      - '.github/workflows/create_llvm.yml'
   workflow_dispatch:
 
 permissions: {}
@@ -54,7 +54,7 @@ jobs:
     steps:
       - name: Cache llvm
         id: cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path:
             llvm_install/**
@@ -79,7 +79,7 @@ jobs:
         with:
           sparse-checkout: |
             platform
-          path: ock          
+          path: ock
 
       - name: Install Ninja
         if: steps.cache.outputs.cache-hit != 'true'

.github/workflows/create_publish_artifacts.yml

@@ -101,7 +101,7 @@ jobs:
           fi
 
       - name: Create OCK pre-release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
         with:

.github/workflows/docs.yml

@@ -44,6 +44,6 @@ jobs:
           cmake --build build_doc --target doc_html
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v1
+        uses: actions/upload-pages-artifact@v3
         with:
           path: ${{github.workspace}}/build_doc/doc/html

.github/workflows/run_ock_demo.yml

@@ -208,7 +208,7 @@ jobs:
           tar -rf ock_demo_components.tar.gz portDNN_build.tar.gz portBLAS_build.tar.gz
 
       - name: Create OCK demo release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
         with:
@@ -220,4 +220,4 @@ jobs:
           name: OCK Demo Package ${{ steps.tag.outputs.TAG }}
           prerelease: true
           body: "ock-demo build ${{ steps.tag.outputs.TAG }}"
-          target_commitish: ${{ github.sha }}
+          target_commitish: ${{ github.sha }}

.github/workflows/run_pr_tests.yml

@@ -32,14 +32,14 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
-      
+
       # installs tools, ninja, installs llvm and sets up sccahe
       - name: setup-ubuntu
         uses:  ./.github/actions/setup_ubuntu_build
         with:
           llvm_version: 18
-          llvm_build_type: RelAssert        
-  
+          llvm_build_type: RelAssert
+
       # These need to match the configurations of build_pr_cache to use the cache effectively
       - name: build host x86_64 online release
         uses: ./.github/actions/do_build_ock
@@ -69,14 +69,14 @@ jobs:
           ninja -C build_offline check-ock-UnitCL
 
   # build and run riscv m1, execute UnitCL and lit tests
-  run_riscv_m1:  
+  run_riscv_m1:
 
     runs-on: ubuntu-22.04
 
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
-      
+
       # installs tools, ninja, installs llvm and sets up sccahe
       - name: setup-ubuntu
         uses:  ./.github/actions/setup_ubuntu_build
@@ -85,7 +85,7 @@ jobs:
           llvm_build_type: RelAssert
 
       - name: build riscv M1
-        uses: ./.github/actions/do_build_ock/do_build_m1  
+        uses: ./.github/actions/do_build_ock/do_build_m1
 
       - name: run riscv M1 lit
         run:

.github/workflows/scorecard.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
           persist-credentials: false
 
@@ -48,6 +48,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@461ef6c76dfe95d5c364de2f431ddbd31a417628 # v3.26.9
+        uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
         with:
           sarif_file: results.sarif

README.md

@@ -1,5 +1,5 @@
 [![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-1.4-4baaaa.svg)](CODE_OF_CONDUCT.md)
-[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/codeplaysoftware/Template-Repo/badge)](https://scorecard.dev/viewer/?uri=github.com/codeplaysoftware/Template-Repo)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/codeplaysoftware/oneapi-construction-kit/badge)](https://scorecard.dev/viewer/?uri=github.com/codeplaysoftware/oneapi-construction-kit)
 
 # oneAPI Construction Kit