name: OSV-Scanner Scheduled Scan

on:
  schedule:
    - cron: 0 4 * * 1

permissions:
  # Require writing security events to upload SARIF file to security tab
  security-events: write
  # Only need to read contents
  contents: read

jobs:
  scan-scheduled:
    if: github.repository == 'tensorflow/tensorflow'
    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v1.6.2-beta1"
    with:
      scan-args: |-

            type=registry,ref=gcr.io/tensorflow-sigs/build:${{ github.event.number }}-${{ matrix.python-version }}
          cache-to: type=inline
      -
        name: Add a comment with the pushed containers
        uses: mshick/add-pr-comment@a65df5f64fc741e91c59b8359a4bc56e57aaf5b1 # v2
        if: contains(github.event.pull_request.labels.*.name, 'build and push to gcr.io for staging')
        with:

# security path
security_path:
   - tensorflow/security
# words checklist
segfault_memory:
   - segfault
   - memory leaks
# assignees
filesystem_security_assignee:
   - mihaimaruseac
   
# Cuda Comment
cuda_comment: >
   From the template it looks like you are installing **TensorFlow** (TF) prebuilt binaries:
      * For TF-GPU - See point 1
      * For TF-CPU - See point 2

# script to run pip-compile for each requirement.
# if there is a change in requirements.in then all lock files will be updated
# accordingly

# All commands run relative to this directory
cd "$(dirname "${BASH_SOURCE[0]}")"

mv BUILD.bazel BUILD

SUPPORTED_VERSIONS=("3_9" "3_10" "3_11" "3_12")

for VERSION in "${SUPPORTED_VERSIONS[@]}"
do

# limitations under the License.
# ==============================================================================

name: PyLint
on:
  pull_request:
    paths:
      - '**.py'

permissions:
  contents: read

jobs:
  build:
    name: PyLint
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0

# ==============================================================================

name: ARM CI Extended C++

on:
  push:
    tags:
      - v2.**
  schedule:
    - cron: '0 2 * * *'

permissions:
  contents: read

jobs:
  build:
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    runs-on: [self-hosted, linux, ARM64]
    strategy:
      matrix:
        pyver: ['3.10']
    steps:

name: ARM CD

on:
  push:
    tags:
      - v2.**
    branches:
      - r2.**
  schedule:
    - cron: '0 8 * * *'

permissions:
  contents: read

jobs:
  build:
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    runs-on: [self-hosted, linux, ARM64]
    strategy:
      fail-fast: false
      matrix:

RUN /setup.python.sh python3.9 devel.requirements.txt
RUN /setup.python.sh python3.10 devel.requirements.txt
RUN /setup.python.sh python3.11 devel.requirements.txt
RUN /setup.python.sh python3.12 devel.requirements.txt
# "python3" commands by default run under 3.10

cat <<EOF
IMPORTANT: These tests ran under docker. This script does not clean up the
container for you! You can delete the container with:

$ docker rm -f tf

You can also execute more commands within the container with e.g.:

$ docker exec tf bazel clean
$ docker exec -it tf bash
EOF

name: Set nightly branch to master HEAD

permissions: {}

jobs:
  master-to-nightly:
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - uses: zofrex/mirror-branch@a8809f0b42f9dfe9b2c5c2162a46327c23d15266 # v1.0.3
      name: Set nightly branch to master HEAD
      with: