schedule:
    - cron: '45 9 * * 0'
  push:
    branches: [ "master" ]

# Declare default permissions as read only.
permissions: read-all

jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload the results to code-scanning dashboard.
      security-events: write
      # Needed to publish results and get a badge (see publish_results below).

    branches:
      - r2.**
  schedule:
    - cron: '0 8 * * *'

permissions:
  contents: read

jobs:
  build:
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    runs-on: [self-hosted, linux, ARM64]
    strategy:
      fail-fast: false
      matrix:
        pyver: ['3.9', '3.10', '3.11', '3.12']
    steps:
      - name: Stop old running containers (if any)
        shell: bash

# flag portability issues in builders named "misc-compile" or "all-compile".
# As of CL 464955, the build system uses make.bash -compile-only instead,
# so this script no longer runs in any automated fashion.
#
# Options:
#   -e: stop at first failure

if [ ! -f run.bash ]; then
	echo 'buildall.bash must be run from $GOROOT/src' 1>&2
	exit 1
fi

sete=false
if [ "$1" = "-e" ]; then

                    import org.gradle.api.Incubating;

                    $v2
                    """
                )
            },
            block = block
        )

    /**
     * Runs the binary compatibility check against two source trees.
     *
     * The fixture build supports both Java and Kotlin sources.
     *
     * @param v1 sources producer for V1, receiver is the `src/main` directory

# and it does not seem possible to e.g. copy "gs://foo/bar" as anything other than
# "/path/bar". This script uses "gsutil rsync" instead, which acts on directory
# contents. About arguments to gsutil:
# "gsutil -m rsync" runs in parallel.
# "gsutil rsync -r" is recursive and makes directories work.
# "gsutil rsync -d" is "sync and delete files from destination if not present in source"

DOWNLOADS="$(mktemp -d)"
mkdir -p "$DOWNLOADS"

		cpuNiceVal := math.Round(ts.Nice/tot*100*100) / 100
		m.Set(sysCPUNice, cpuNiceVal)
		cpuStealVal := math.Round(ts.Steal/tot*100*100) / 100
		m.Set(sysCPUSteal, cpuStealVal)
	}

	// metrics-resource.go runs a job to collect resource metrics including their Avg values and
	// stores them in resourceMetricsMap. We can use it to get the Avg values of CPU idle and IOWait.
	cpuResourceMetrics, found := resourceMetricsMap[cpuSubsystem]

# Gradle runtimes

Gradle is made up of the following processes that work together to "run the build":

- Gradle daemon. This is the process that actually runs the build. It hosts build logic and coordinates the lifecycle of the build. It is a long-running daemon process.
- CLI client. This is the `gradle` or `gradlew` command, and is responsible for locating, starting and interacting with the Gradle daemon, potentially downloading the Gradle distribution. 

### Fixing sanity check failures after public API changes

If your PR includes any changes to the Gradle Public API, it will cause the binary compatibility check to fail.
The binary compatibility check runs as a part of the broader sanity check.
The latter runs on every PR and is a prerequisite for merging.

If you run the sanity check locally with the `./gradlew sanityCheck`, you can see the binary compatibility error in the output.

All replication failures are picked up by the scanner which runs at a one minute frequency, each time scanning up to a sixteenth of the namespace. Object versions marked `PENDING` or `FAILED` are re-queued for replication.

    # Only shows Added, Changed, Modified, Renamed, and Type-changed files
    if [[ "$(git rev-parse --abbrev-ref HEAD)" == "pull_branch" ]]; then
        # TF's CI runs 'git fetch origin "pull/PR#/merge:pull_branch"'
        # To get the as-merged branch during the CI tests
        git diff --diff-filter ACMRT --name-only pull_branch^ pull_branch > $BATS_FILE_TMPDIR/changed_files
    else