# Disable ALL uploads of any kind.
TFCI_ARTIFACT_FINAL_GCS_ENABLE=
TFCI_ARTIFACT_FINAL_GCS_SA_PATH=
TFCI_ARTIFACT_FINAL_GCS_URI=
TFCI_ARTIFACT_FINAL_PYPI_ARGS=
TFCI_ARTIFACT_FINAL_PYPI_ENABLE=
TFCI_ARTIFACT_LATEST_GCS_URI=
TFCI_ARTIFACT_STAGING_GCS_ENABLE=
TFCI_ARTIFACT_STAGING_GCS_URI=

  # from get_versions.sh, which must be run *after* update_version.py, FINAL_URI
  # can't be set inside the rest of the _upload envs.
  FINAL_URI="$TFCI_ARTIFACT_FINAL_GCS_URI/$TF_VER_FULL"
  gsutil -m rsync -d -r "$DOWNLOADS" "$FINAL_URI"

  # Also mirror the latest-uploaded folder to the "latest" directory.
  # GCS does not support symlinks.
  gsutil -m rsync -d -r "$FINAL_URI" "$TFCI_ARTIFACT_LATEST_GCS_URI"
fi

#       ./any.sh
#       ...
set -euxo pipefail
cd "$(dirname "$0")/../../"  # tensorflow/
# Any request that includes "nightly_upload" should just use the
# local multi-cache (public read-only cache + disk cache) instead.
export TFCI="$(echo $TFCI | sed 's/,nightly_upload/,public_cache,disk_cache/')"
if [[ -n "${TF_ANY_EXTRA_ENV:-}" ]]; then
  export TFCI="$TFCI,$TF_ANY_EXTRA_ENV"
fi
if [[ -n "${TF_ANY_SCRIPT:-}" ]]; then

# Release jobs are very basic. They don't use any caching or RBE,
# but they do upload logs to resultstore.
# IMPORTANT: trailing slash is required on GCS URIs, as it tells gcloud to
# pretend the path is a directory.
TFCI_ARTIFACT_FINAL_GCS_ENABLE=1
TFCI_ARTIFACT_FINAL_GCS_SA_PATH="${KOKORO_KEYSTORE_DIR}/73361_tensorflow_release_binary_uploader_service_account"
TFCI_ARTIFACT_FINAL_GCS_URI="gs://tensorflow/versions/"

          publish_results: true

      # Upload the results as artifacts (optional).
      - name: "Upload artifact"
        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"

      - name: Upload pip wheel to PyPI
        if: github.event_name == 'schedule' || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v2')) # only if it is a scheduled nightly or tagged
        shell: bash

# ==============================================================================

name: OSV-Scanner Scheduled Scan

on:
  schedule:
    - cron: 0 4 * * 1

permissions:
  # Require writing security events to upload SARIF file to security tab
  security-events: write
  # Only need to read contents
  contents: read

jobs:
  scan-scheduled:
    if: github.repository == 'tensorflow/tensorflow'

build:sigbuild_local_cache --disk_cache=/tf/cache
# Use the public-access TF DevInfra cache (read only)
build:sigbuild_remote_cache --remote_cache="https://storage.googleapis.com/tensorflow-devinfra-bazel-cache/manylinux2014" --remote_upload_local_results=false
# Change the value of CACHEBUSTER when upgrading the toolchain, or when testing
# different compilation methods. E.g. for a PR to test a new CUDA version, set
# the CACHEBUSTER to the PR number.

#    See full examples below for more details on these. Some other modifiers are:
#      Ex. versions_upload -- for TF official release versions
#      Ex. nightly_upload -- for TF nightly official builds; changes version numbers
#      Ex. no_upload      -- Disable all uploads, usually for temporary CI issues

# Recommended: use a local+remote cache.
#

# IMPORTANT: trailing slash is required on GCS URIs, as it tells gcloud to
# pretend the path is a directory.
# 1. Upload nightlies
TFCI_ARTIFACT_FINAL_GCS_ENABLE=1
TFCI_ARTIFACT_FINAL_GCS_SA_PATH="${KOKORO_KEYSTORE_DIR}/73361_tensorflow_release_binary_uploader_service_account"
TFCI_ARTIFACT_FINAL_GCS_URI="gs://tensorflow/nightly/"