Skip to content

Commit 4a084c8

Browse files
BensuoBensuo
authored
Merge branch 'main' into maxime/imm-cmd-list-support
2 parents ce75720 + 9f88cf8 commit 4a084c8

File tree

17 files changed

+365
-96
lines changed

17 files changed

+365
-96
lines changed

‎.github/workflows/bandit.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,17 @@ concurrency:
77
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
88
cancel-in-progress: true
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
linux:
1215
name: Bandit
1316
runs-on: ubuntu-latest
1417

1518
steps:
1619
- name: Clone the git repo
17-
uses: actions/checkout@v3
20+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
1821

1922
- name: Install pip packages
2023
run: pip install -r third_party/requirements.txt

‎.github/workflows/cmake.yml

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ concurrency:
66
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
77
cancel-in-progress: true
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
ubuntu-build:
1114
name: Build - Ubuntu
@@ -36,7 +39,7 @@ jobs:
3639
runs-on: ${{matrix.os}}
3740

3841
steps:
39-
- uses: actions/checkout@v3
42+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
4043

4144
- name: Install apt packages
4245
run: |
@@ -122,7 +125,7 @@ jobs:
122125
runs-on: 'ubuntu-22.04'
123126

124127
steps:
125-
- uses: actions/checkout@v3
128+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
126129

127130
- name: Install pip packages
128131
run: pip install -r third_party/requirements.txt
@@ -174,7 +177,7 @@ jobs:
174177
runs-on: ${{matrix.adapter.name}}
175178

176179
steps:
177-
- uses: actions/checkout@v3
180+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
178181

179182
- name: Install pip packages
180183
run: pip install -r third_party/requirements.txt
@@ -240,13 +243,13 @@ jobs:
240243
runs-on: ${{matrix.adapter.name}}
241244

242245
steps:
243-
- uses: actions/checkout@v3
246+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
244247

245248
- name: Install pip packages
246249
run: pip install -r third_party/requirements.txt
247250

248251
- name: Init conda env
249-
uses: conda-incubator/setup-miniconda@v2
252+
uses: conda-incubator/setup-miniconda@9f54435e0e72c53962ee863144e47a4b094bfd35 # v2.3.0
250253
with:
251254
miniconda-version: "latest"
252255
activate-environment: examples
@@ -306,9 +309,9 @@ jobs:
306309
runs-on: ${{matrix.os}}
307310

308311
steps:
309-
- uses: actions/checkout@v3
312+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
310313

311-
- uses: actions/setup-python@v4
314+
- uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
312315
with:
313316
python-version: 3.9
314317

@@ -357,9 +360,9 @@ jobs:
357360
runs-on: ${{matrix.os}}
358361

359362
steps:
360-
- uses: actions/checkout@v3
363+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
361364

362-
- uses: actions/setup-python@v4
365+
- uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
363366
with:
364367
python-version: 3.9
365368

‎.github/workflows/codeql.yml

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ concurrency:
66
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
77
cancel-in-progress: true
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
analyze-ubuntu:
1114
name: Analyze on Ubuntu
@@ -18,10 +21,10 @@ jobs:
1821

1922
steps:
2023
- name: Checkout repository
21-
uses: actions/checkout@v3
24+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2225

2326
- name: Initialize CodeQL
24-
uses: github/codeql-action/init@v2
27+
uses: github/codeql-action/init@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12
2528
with:
2629
languages: cpp, python
2730

@@ -35,7 +38,7 @@ jobs:
3538
run: cmake --build ${{github.workspace}}/build -j $(nproc)
3639

3740
- name: Perform CodeQL Analysis
38-
uses: github/codeql-action/analyze@v2
41+
uses: github/codeql-action/analyze@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12
3942

4043
analyze-windows:
4144
name: Analyze on Windows
@@ -48,10 +51,10 @@ jobs:
4851

4952
steps:
5053
- name: Checkout repository
51-
uses: actions/checkout@v3
54+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
5255

5356
- name: Initialize CodeQL
54-
uses: github/codeql-action/init@v2
57+
uses: github/codeql-action/init@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12
5558
with:
5659
languages: cpp, python
5760

@@ -65,4 +68,4 @@ jobs:
6568
run: cmake --build ${{github.workspace}}/build -j $(nproc) --config Release
6669

6770
- name: Perform CodeQL Analysis
68-
uses: github/codeql-action/analyze@v2
71+
uses: github/codeql-action/analyze@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12

‎.github/workflows/coverage.yml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ name: Coverage
22

33
on: [push, pull_request]
44

5+
permissions:
6+
contents: read
7+
58
jobs:
69
ubuntu-build:
710
name: Build - Ubuntu
@@ -16,7 +19,7 @@ jobs:
1619
runs-on: ${{matrix.os}}
1720

1821
steps:
19-
- uses: actions/checkout@v3
22+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2023

2124
- name: Install apt packages
2225
run: |
@@ -72,7 +75,7 @@ jobs:
7275
run: ctest -T Coverage
7376

7477
- name: Upload coverage to Codecov
75-
uses: codecov/codecov-action@v3
78+
uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
7679
with:
7780
gcov: true
7881
gcov_include: source

‎.github/workflows/coverity.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ env:
2323
COVERITY_SCAN_BRANCH_PATTERN: "main"
2424
TRAVIS_BRANCH: ${{ github.ref_name }}
2525

26+
permissions:
27+
contents: read
2628

2729
jobs:
2830
linux:
@@ -31,7 +33,7 @@ jobs:
3133

3234
steps:
3335
- name: Clone the git repo
34-
uses: actions/checkout@v3
36+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
3537

3638
- name: Install pip packages
3739
run: pip install -r third_party/requirements.txt

‎.github/workflows/docs.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ jobs:
2626
runs-on: ubuntu-latest
2727
steps:
2828
- name: Checkout
29-
uses: actions/checkout@v3
29+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
3030

31-
- uses: actions/setup-python@v4
31+
- uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
3232
with:
3333
python-version: 3.9
3434

@@ -41,14 +41,14 @@ jobs:
4141
run: python3 -m pip install -r third_party/requirements.txt
4242

4343
- name: Setup Pages
44-
uses: actions/configure-pages@v2
44+
uses: actions/configure-pages@c5a3e1159e0cbdf0845eb8811bd39e39fc3099c2 # v2.1.3
4545

4646
- name: Build Documentation
4747
working-directory: ${{github.workspace}}/scripts
4848
run: python3 run.py --core
4949

5050
- name: Upload artifact
51-
uses: actions/upload-pages-artifact@v1
51+
uses: actions/upload-pages-artifact@84bb4cd4b733d5c320c9c9cfbc354937524f4d64 # v1.0.10
5252
with:
5353
path: ${{github.workspace}}/docs/html
5454

@@ -62,4 +62,4 @@ jobs:
6262
steps:
6363
- name: Deploy to GitHub Pages
6464
id: deployment
65-
uses: actions/deploy-pages@v1
65+
uses: actions/deploy-pages@f27bcc15848fdcdcc02f01754eb838e44bcf389b # v1.2.9

‎.github/workflows/e2e_nightly.yml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
# Run every day at 23:00 UTC
66
- cron: '0 23 * * *'
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
e2e-build-hw:
1013
name: Build SYCL, UR, run E2E
@@ -29,12 +32,12 @@ jobs:
2932
rm -rf ./* || true
3033
3134
- name: Checkout UR
32-
uses: actions/checkout@v4
35+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3336
with:
3437
path: ur-repo
3538

3639
- name: Checkout SYCL
37-
uses: actions/checkout@v4
40+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3841
with:
3942
repository: intel/llvm
4043
ref: sycl

‎.github/workflows/nightly.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
# Run every day at 23:00 UTC
66
- cron: '0 23 * * *'
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
long-fuzz-test:
1013
name: Run long fuzz tests
@@ -16,7 +19,7 @@ jobs:
1619
runs-on: 'ubuntu-22.04'
1720

1821
steps:
19-
- uses: actions/checkout@v3
22+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
2023

2124
- name: Install pip packages
2225
run: pip install -r third_party/requirements.txt

‎.github/workflows/prerelease.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,16 @@ on:
66
# At 23:00 on Friday, GitHub actions schedule is in UTC time.
77
- cron: 0 23 * * 5
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
weekly-prerelease:
1114
runs-on: ubuntu-latest
1215
permissions:
1316
contents: write
1417
steps:
15-
- uses: actions/checkout@v3
18+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
1619

1720
- name: Create weekly prerelease
1821
run:

‎.github/workflows/scorecard.yml

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: Scorecard supply-chain security
6+
on:
7+
# For Branch-Protection check. Only the default branch is supported. See
8+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9+
branch_protection_rule:
10+
# To guarantee Maintained check is occasionally updated. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12+
workflow_dispatch:
13+
schedule:
14+
- cron: '45 22 * * 4'
15+
push:
16+
branches: [ "main" ]
17+
18+
# Declare default permissions as read only.
19+
permissions: read-all
20+
21+
jobs:
22+
analysis:
23+
name: Scorecard analysis
24+
runs-on: ubuntu-latest
25+
permissions:
26+
# Needed to upload the results to code-scanning dashboard.
27+
security-events: write
28+
# Needed to publish results and get a badge (see publish_results below).
29+
id-token: write
30+
# Uncomment the permissions below if installing in a private repository.
31+
# contents: read
32+
# actions: read
33+
34+
steps:
35+
- name: "Checkout code"
36+
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
37+
with:
38+
persist-credentials: false
39+
40+
- name: "Run analysis"
41+
uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2
42+
with:
43+
results_file: results.sarif
44+
results_format: sarif
45+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
46+
# - you want to enable the Branch-Protection check on a *public* repository, or
47+
# - you are installing Scorecard on a *private* repository
48+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
49+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
50+
51+
# Public repositories:
52+
# - Publish results to OpenSSF REST API for easy access by consumers
53+
# - Allows the repository to include the Scorecard badge.
54+
# - See https://github.com/ossf/scorecard-action#publishing-results.
55+
# For private repositories:
56+
# - `publish_results` will always be set to `false`, regardless
57+
# of the value entered here.
58+
publish_results: true
59+
60+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
61+
# format to the repository Actions tab.
62+
- name: "Upload artifact"
63+
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
64+
with:
65+
name: SARIF file
66+
path: results.sarif
67+
retention-days: 5
68+
69+
# Upload the results to GitHub's code scanning dashboard.
70+
- name: "Upload to code-scanning"
71+
uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
72+
with:
73+
sarif_file: results.sarif

0 commit comments

Comments
 (0)