EOF
  exit 1
fi
TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --config rbe_$TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX"

# These flags share the user's gcloud credentials with the container, so that bazel
# inside the container can authenticate. Note: TF's CI does not have any credential
# stored here.

    [Environment]::SetEnvironmentVariable(\"PATH\", $old_path + \";${pkg_extracted_path}\bin\", \"Machine\"); \
    $env:PATH = [Environment]::GetEnvironmentVariable('PATH', 'Machine'); \
    gcloud components install docker-credential-gcr kubectl gsutil;

# Install cygwin and packages
# Running a seperate ps1 file since when running inside a Dockerfile, it does
# not work.
COPY install/install_cygwin.ps1 c:/
RUN c:/install_cygwin.ps1; \

      security-events: write
      id-token: write

    steps:
      - name: "Checkout code"
        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
        with:
          persist-credentials: false

      - name: "Run analysis"
        uses: ossf/scorecard-action@15c10fcf1cf912bd22260bfec67569a359ab87da # v2.1.1
        with:
          results_file: results.sarif
          results_format: sarif

set +x
if [[ -n "${GOOGLE_APPLICATION_CREDENTIALS:-}" ]]; then
  # Python 3.12 removed the module `imp` which is needed by gcloud CLI so we set
  # `CLOUDSDK_PYTHON` to Python 3.11 which is the system Python on TFCI Mac
  # VMs.
  export CLOUDSDK_PYTHON=$(which python3.11)
  gcloud auth activate-service-account --key-file="${GOOGLE_APPLICATION_CREDENTIALS}"
fi
set -x

# Public cache for macOS builds
build:tf_public_macos_cache --remote_cache="https://storage.googleapis.com/tensorflow-macos-bazel-cache/oct2023" --remote_upload_local_results=false
# Cache pushes are limited to TF's CI system.
build:tf_public_macos_cache_push --config=tf_public_macos_cache --remote_upload_local_results=true --google_default_credentials

# END TF CACHE HELPER OPTIONS