# limitations under the License.
# ==============================================================================

name: Trusted Partner PR
on:
  pull_request_target:

permissions:
  contents: read

jobs:
  assign-partner-tags:
    runs-on: ubuntu-latest
    permissions:
      # Needed to attach tags into the PR
      issues: write
      contents: write

  gsutil cp -n "$TFCI_OUTPUT_DIR"/*.whl "$TFCI_ARTIFACT_STAGING_GCS_URI"
fi

if [[ "$TFCI_WHL_BAZEL_TEST_ENABLE" == 1 ]]; then
  tfrun bazel test $TFCI_BAZEL_COMMON_ARGS --config="${TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX}_wheel_test"

                     uint64* file_size) override;
  Status RenameFile(const std::string& src, const std::string& target,
                    TransactionToken* token) override;
  Status CopyFile(const std::string& src, const std::string& target,
                  TransactionToken* token) override;
  std::string TranslateName(const std::string& name) const override;

        with:
          push: ${{ contains(github.event.pull_request.labels.*.name, 'build and push to gcr.io for staging') }}
          context: ./tensorflow/tools/tf_sig_build_dockerfiles
          target: devel
          build-args: |
            PYTHON_VERSION=${{ matrix.python-version }}
            CACHEBUSTER=${{ steps.date.outputs.DATE }}
          tags: |

  ///   * Must set `status` to `TF_NOT_FOUND` if `path` doesn't point to an
  ///     existing file or one of the parent entries in `path` doesn't exist.
  ///   * Must set `status` to `TF_FAILED_PRECONDITION` if `path` points to a
  ///     directory or if it is invalid (e.g., malformed, or has a parent entry
  ///     which is a file).
  ///   * Might use any other error value for `status` to signal other errors.
  ///

fi
set -x

# When cross-compiling with RBE, we need to copy the macOS sysroot to be
# inside the TensorFlow root directory. We then define them as a filegroup
# target inside "tensorflow/tools/toolchains/cross_compile/cc" so that Bazel
# can register it as an input to compile/link actions and send it to the remote
# VMs when needed.

ways to detect malicious models/graphs/checkpoints, so the recommended way to
mitigate the risk in this scenario is to sandbox the model execution.

### Hardware attacks

Physical GPUs or TPUs can also be the target of attacks. [Published
research](https://scholar.google.com/scholar?q=gpu+side+channel) shows that it
might be possible to use side channel attacks on the GPU to leak data from other

        "cpu": "mips64",
    },
    visibility = ["//visibility:public"],
)

# TODO(jakeharmon8): Remove in favor of TSL version
config_setting(
    name = "windows",
    # Internal builds query the target OS.
    constraint_values = if_google(
        ["//third_party/bazel_platforms/os:windows"],
        [],
    ),
    # OSS builds query the CPU type.
    values = if_oss(
        {"cpu": "x64_windows"},

      ImmediateExecutionTensorHandle* handle,
      const tensorflow::string& target_device_name,
      ImmediateExecutionTensorHandle** result) override {
    TF_Status status;
    handle->Ref();
    TFE_TensorHandle* result_handle = device_.copy_tensor_from_device(
        context_, tensorflow::wrap(handle), target_device_name.c_str(), &status,
        info_);
    handle->Unref();

*   <IF RELEASE CONTAINS MULTIPLE FEATURES FROM SAME AREA, GROUP THEM TOGETHER>

*   Add `is_cpu_target_available`, which indicates whether or not TensorFlow was
    built with support for a given CPU target. This can be useful for skipping
    target-specific tests if a target is not supported.

*   `tf.data`
    * Support `data.experimental.distribued_save`. `distribued_save` uses
      tf.data service