name: Scorecard supply-chain security
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:
    - cron: '45 9 * * 0'
  push:
    branches: [ "master" ]

  // Rewrite the branches.
  RegionRange branches = case_op.getRegions();

  for (Region* branch : branches) {
    if (failed(DecomposeTensorListOpsInternal(
            &branch->front(), module, buffer_to_size,
            decomposed_partitioned_call_callees)))
      return failure();
  }

  // Get the output buffer index to size index mapping one of the branches. It

// else branch of the first comparison is executed, we already know that i < len(a).
// The code for the second panic can be removed.
//
// prove works by finding contradictions and trimming branches whose
// conditions are unsatisfiable given the branches leading up to them.
// It tracks a "fact table" of branch conditions. For each branching
// block, it asserts the branch conditions that uniquely dominate that

  // CHECK: [[idx:%.*]] = tf_mlrt.tensor_to_int32 [[tf_idx]]
  // CHECK-NEXT: [[out:%.*]] = mlrt.case [[idx]] [@branch0, @branch1]([[branch_arg0]], [[branch_arg1]])
  %0 = "tf.Case"(%arg0, %arg1, %arg2) {_lower_using_switch_merge = true, branches = [@branch0, @branch1], is_stateless = true} : (tensor<i32>, tensor<f32>, tensor<f32>) -> tensor<f32>
  func.return %0 : tensor<f32>
}

// -----

# tag that appears in any commit that is a (transitive) parent of the commit
# supplied to 'go get', regardless of branches

[short] skip
[!git] skip

# For this test repository:
#  tag v0.2.1 is most recent tag on master itself
#  tag v0.2.2 is on branch2, which was then merged to master
#  master is a merge commit with both tags as parents
#
# The pseudo-version hence sorts immediately after v0.2.2 rather

                                } catch (Throwable e) {
                                  echo "Failure checkout ITs branch: ${ITS_BRANCH} - fallback master branch"
                                  checkout([$class: 'GitSCM',
                                          branches: [[name: "*/master"]],
                                          extensions: [[$class: 'CloneOption', depth: 1, noTags: true, shallow: true]],

This defeats <<incremental_build.adoc#incremental_build,incremental build>> (i.e., `UP-TO-DATE` checks), but this issue is mitigated via use of the local build cache.
You might run a build on Branch A, which will populate the local cache.
You then switch to Branch B to conduct a code review, help a colleague, or address feedback on an open PR.
You then switch back to Branch A to continue your original work.

                                branch11 = selection.getDescriptor(IvyModuleDescriptor).branch
                            } else {
                                selection.reject('not 1.1')
                            }
                        }
                    }
                }
            }
        """

        when:
        buildFile.text = """
            $commonBuildFile

    fun `publish milestone build type runs three gradle invocations`(branch: String, promoteTaskName: String) {
        val model = setupModelFor(branch)
        val nightlySnapshot = model.findBuildTypeByName("Release - Milestone")

        val steps = nightlySnapshot.steps.items
        assertEquals(3, steps.size)

  // CHECK-NEXT: [[idx:%.*]] = corert.tensorhandle_to_int32 [[th_idx]]
  // CHECK-NEXT: [[out:%.*]] = tfrt.case [[idx]] [@branch0, @branch1]([[chain]], [[branch_arg0]], [[branch_arg1]])
  %0 = "tf.Case"(%arg0, %arg1, %arg2) {_lower_using_switch_merge = true, branches = [@branch0, @branch1], is_stateless = true} : (tensor<i32>, tensor<f32>, tensor<f32>) -> tensor<f32>
  func.return %0 : tensor<f32>