schedule:
    - cron: 0 4 * * *  # 4am UTC is 9pm PDT and 8pm PST
name: Set nightly branch to master HEAD

permissions: {}

jobs:
  master-to-nightly:
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - uses: zofrex/mirror-branch@a8809f0b42f9dfe9b2c5c2162a46327c23d15266 # v1.0.3

py_repositories()

## Load HERMETIC_PYTHON_VERSION variable
local_repository(
    name = "local_tensorflow",
    path = "../../..",
)

load(
    "@local_tensorflow//tensorflow/tools/toolchains/python:python_repo.bzl",
    "python_repository",
)

python_repository(name = "python_version_repo")

load("@python_version_repo//:py_version.bzl", "TF_PYTHON_VERSION")

# More Python versions: Deadsnakes
deb http://ppa.launchpad.net/deadsnakes/ppa/ubuntu focal main
deb-src http://ppa.launchpad.net/deadsnakes/ppa/ubuntu focal main

# LLVM/Clang 17 repository
deb http://apt.llvm.org/focal/ llvm-toolchain-focal-17 main
deb-src http://apt.llvm.org/focal/ llvm-toolchain-focal-17 main

permissions:
  # Require writing security events to upload SARIF file to security tab
  security-events: write
  # Only need to read contents
  contents: read

jobs:
  scan-scheduled:
    if: github.repository == 'tensorflow/tensorflow'
    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v1.6.2-beta1"
    with:
      scan-args: |-
        --lockfile=requirements.txt:./requirements_lock_3_9.txt

TFCI_ARTIFACT_FINAL_GCS_URI="gs://tensorflow/versions/"
TFCI_ARTIFACT_FINAL_PYPI_ARGS="--config-file=$KOKORO_KEYSTORE_DIR/73361_tensorflow_pypirc_using_global_api_token --repository pypi-warehouse"
TFCI_ARTIFACT_FINAL_PYPI_ENABLE=1
TFCI_ARTIFACT_LATEST_GCS_URI="gs://tensorflow/versions/latest/"
TFCI_ARTIFACT_STAGING_GCS_ENABLE=1

  branch_protection_rule:
  schedule:
    - cron: '44 15 * * 5'
  push:
    branches: [ master ]

# Declare default permissions as read only.
permissions: read-all

jobs:
  analysis:
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    name: Scorecards analysis
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload the results to code-scanning dashboard.
      security-events: write

on:
  push:
    paths:
      - CITATION.cff

permissions:
  contents: read

jobs:
  validate:
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    name: "validate"
    runs-on: ubuntu-latest
    steps:
      - name: Check out a copy of the repository
        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0

#
# setup.python.sh: Install a specific Python version and packages for it.
# Usage: setup.python.sh <pyversion> <requirements.txt>
set -xe

source ~/.bashrc
VERSION=$1
REQUIREMENTS=$2

add-apt-repository ppa:deadsnakes/ppa
# Install Python packages for this container's version
cat >pythons.txt <<EOF
$VERSION
$VERSION-dev
$VERSION-venv
$VERSION-distutils
EOF
/setup.packages.sh pythons.txt

permissions:
  contents: read

jobs:
  cherrypick:
    name: Cherrypick to ${{ github.event.inputs.release_branch}} - ${{ github.event.inputs.git_commit }}
    runs-on: ubuntu-latest
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    steps:
    - name: Checkout code
      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
      with:

# for running smoke tests in nightly/release wheel builds.
if [[ "${TFCI_MACOS_UPGRADE_PYENV_ENABLE}" == 1 ]]; then
  # The TFCI Mac VM image seems to have uncommitted local changes to the Pyenv
  # repository so we have to discard them and reset the working directory before
  # we can pull in the latest changes.
  cd /Users/kbuilder/.pyenv/ && git reset --hard HEAD && git pull && cd -
fi