Merge branch 'master' into feat-llm

Author: farook-edev

.github/workflows/android-build-test.yml

@@ -13,8 +13,7 @@ jobs:
     steps:
       - name: "MLCommons CLA bot check"
         if: (github.event.comment.body == 'recheck') || github.event_name == 'pull_request_target'
-        # Alpha Release
-        uses: mlcommons/cla-bot@master
+        uses: mlcommons/cla-bot@7b057420c71213d7674820c9110857539e9e552f # v3.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # the below token should have repo scope and must be manually added by you in the repository's secret

.github/workflows/cla.yml

@@ -28,7 +28,7 @@ jobs:
       WITH_PIXEL: 1
       FIREBASE_PROJECT_ID: ${{ secrets.FIREBASE_PROJECT_ID }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           fetch-depth: 0
       - name: Free up disk space
@@ -39,22 +39,22 @@ jobs:
           echo AFTER:
           df -h
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Extract metadata for base image
         id: meta-base
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
         with:
           images: ghcr.io/mlcommons/mobile_app_open-base
           flavor: latest=true
           tags: type=raw,value=${{ github.run_number }}
       - name: Build and push base image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: flutter/android/docker
           file: flutter/android/docker/Dockerfile
@@ -65,13 +65,13 @@ jobs:
           cache-to: type=gha,mode=max
       - name: Extract metadata for scanner image
         id: meta-scanner
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
         with:
           images: ghcr.io/mlcommons/mobile_app_open-scanner
           flavor: latest=true
           tags: type=raw,value=${{ github.run_number }}
       - name: Build and push scanner image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: tools/scanner
           file: tools/scanner/Dockerfile
@@ -94,11 +94,11 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11
         with:
           languages: java-kotlin, javascript-typescript, python, actions
           build-mode: none
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11

.github/workflows/code-analysis.yml

@@ -14,24 +14,24 @@ jobs:
       packages: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
         with:
           images: ghcr.io/mlcommons/mobile_app_open-formatter
           flavor: latest=true
           tags: type=raw,value=${{ github.run_number }}
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: tools/formatter
           file: tools/formatter/Dockerfile
@@ -48,7 +48,7 @@ jobs:
       image: ghcr.io/mlcommons/mobile_app_open-formatter:${{ github.run_number }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: configure Git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: bazel
@@ -62,7 +62,7 @@ jobs:
       image: ghcr.io/mlcommons/mobile_app_open-formatter:${{ github.run_number }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: configure Git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: clang
@@ -75,11 +75,11 @@ jobs:
       image: ghcr.io/mlcommons/mobile_app_open-formatter:${{ github.run_number }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: configure Git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Cache Flutter packages
-        uses: actions/cache@v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: /home/mlperf/.pub-cache
           key: ${{ runner.os }}-pub-cache-${{ hashFiles('**/pubspec.lock') }}
@@ -98,7 +98,7 @@ jobs:
       image: ghcr.io/mlcommons/mobile_app_open-formatter:${{ github.run_number }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: configure Git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: swift
@@ -111,7 +111,7 @@ jobs:
       image: ghcr.io/mlcommons/mobile_app_open-formatter:${{ github.run_number }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: configure Git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: markdown-format
@@ -124,7 +124,7 @@ jobs:
       image: ghcr.io/mlcommons/mobile_app_open-formatter:${{ github.run_number }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: configure Git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: pbtxt
@@ -137,7 +137,7 @@ jobs:
       image: ghcr.io/mlcommons/mobile_app_open-formatter:${{ github.run_number }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: configure Git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: yaml
@@ -151,7 +151,7 @@ jobs:
       image: ghcr.io/mlcommons/mobile_app_open-formatter:${{ github.run_number }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: configure Git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: typescripts
@@ -164,7 +164,7 @@ jobs:
       image: ghcr.io/mlcommons/mobile_app_open-formatter:${{ github.run_number }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: configure Git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: prohibited-extensions

.github/workflows/format-and-lint.yml

@@ -9,11 +9,14 @@ on:
 jobs:
   build:
     name: Build and test iOS app
-    # https://github.com/actions/runner-images/blob/main/images/macos/macos-12-Readme.md
-    runs-on: macos-14
+    # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-arm64-Readme.md
+    runs-on: macos-15
     timeout-minutes: 180
     env:
       PERF_TEST: true
+      # Because iPhone simulator on GitHub Actions is not reliable, and caused a lot of test failures,
+      # we run only 1 benchmark to validate the build.
+      BENCHMARK_IDS: "image_classification_v2"
       WITH_APPLE: 1
       WITH_TFLITE: 1
       WITH_PIXEL: 0
@@ -34,15 +37,15 @@ jobs:
       FIREBASE_CRASHLYTICS_ENABLED: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: Cache CocoaPods
-        uses: actions/cache@v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: ${{ github.workspace }}/flutter/ios/Pods
           key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
           restore-keys: ${{ runner.os }}-pods-
       - name: Cache bazel
-        uses: actions/cache@v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: /tmp/bazel_cache
           key: ${{ runner.os }}-bazel_cache-${{ hashFiles('**/BUILD', '**/WORKSPACE') }}
@@ -59,11 +62,17 @@ jobs:
       - name: Build iOS integration tests
         run: |
           cd flutter && flutter --no-version-check build ios --simulator integration_test/first_test.dart
-      - uses: nick-fields/retry@v3
+      - name: Setup iOS simulator
+        env:
+          DEVICE_NAME: "iPhone 16 Pro"
+          RUNTIME_SDK: "iphonesimulator18.5"
+        run: |
+          cd flutter/ios/ci_scripts/ && bash setup_simulator.sh
+          open -a Simulator
+      - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
         name: Run iOS integration tests
         with:
           timeout_minutes: 120
           max_attempts: 2
           command: |
-            open -a Simulator
             make flutter/test/integration

.github/workflows/ios-build-test.yml

@@ -11,14 +11,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: Install Flutter
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046 # v2.19.0
         with:
           channel: 'stable'
           flutter-version: '3.19.6'
       - name: Install Protoc
-        uses: arduino/setup-protoc@v1
+        uses: arduino/setup-protoc@149f6c87b92550901b26acd1632e11c3662e381f # v1.3.0
         with:
           version: '3.x'
           repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/unit-tests.yml

@@ -12,7 +12,7 @@ jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
       - name: Build website
         env:
           REACT_APP_FIREBASE_WEB_API_KEY: ${{ secrets.FIREBASE_WEB_API_KEY }}
@@ -27,7 +27,7 @@ jobs:
           cd ./react
           yarn install --immutable --immutable-cache --check-cache
           yarn build
-      - uses: FirebaseExtended/action-hosting-deploy@v0
+      - uses: FirebaseExtended/action-hosting-deploy@e2eda2e106cfa35cdbcf4ac9ddaf6c4756df2c8c # v0.10.0
         name: Deploy to Firebase Hosting on Preview channel
         if: github.ref != 'refs/heads/master'
         with:
@@ -36,7 +36,7 @@ jobs:
           projectId: mobile-app-build-290400
           entryPoint: "./react"
           expires: 30d
-      - uses: FirebaseExtended/action-hosting-deploy@v0
+      - uses: FirebaseExtended/action-hosting-deploy@e2eda2e106cfa35cdbcf4ac9ddaf6c4756df2c8c # v0.10.0
         name: Deploy to Firebase Hosting on Live channel
         if: github.ref == 'refs/heads/master'
         with:

.github/workflows/web-deploy.yml

@@ -0,0 +1,4 @@
+# Ignore GitHub Actions rule S7637 across the repository
+sonar.issue.ignore.multicriteria=gha1
+sonar.issue.ignore.multicriteria.gha1.ruleKey=githubactions:S7637
+sonar.issue.ignore.multicriteria.gha1.resourceKey=.github/workflows/**/*

.sonarcloud.properties

@@ -26,6 +26,26 @@ tf_patch_finder(
     workspace_dir = __workspace_dir__,
 )
 
+# Override zlib and png version to make it compatible with Xcode 16.4
+http_archive(
+    name = "zlib",
+    build_file = "//third_party:zlib.BUILD",
+    sha256 = "17e88863f3600672ab49182f217281b6fc4d3c762bde361935e436a95214d05c",
+    strip_prefix = "zlib-1.3.1",
+    urls = [
+        "https://github.com/madler/zlib/releases/download/v1.3.1/zlib-1.3.1.tar.gz",
+        "https://github.com/madler/zlib/archive/refs/tags/v1.3.1.tar.gz",
+    ],
+)
+
+http_archive(
+    name = "png",
+    build_file = "//third_party:libpng.BUILD",
+    sha256 = "71158e53cfdf2877bc99bcab33641d78df3f48e6e0daad030afe9cb8c031aa46",
+    strip_prefix = "libpng-1.6.50",
+    urls = ["https://github.com/glennrp/libpng/archive/refs/tags/v1.6.50.tar.gz"],
+)
+
 load("@tf_patch_finder//:patch_win_arm64.bzl", "PATCH_FILE")
 
 http_archive(

WORKSPACE

@@ -0,0 +1,9 @@
+group "default" {
+  targets = ["android"]
+}
+
+target "android" {
+  context    = "flutter/android/docker"
+  dockerfile = "Dockerfile"
+  // platforms = ["linux/amd64"]  // optionally set platforms here
+}