Merge Dev

.github/workflows/ai-pr-review.yml

@@ -10,18 +10,24 @@ permissions:
 
 jobs:
   ai-review:
+    if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.base.ref }}
 
       - name: Install dependencies
         run: |
           pip install requests jq
 
+      - name: Fetch PR head
+        run: |
+          git fetch origin ${{ github.event.pull_request.head.sha }}
+
       - name: Get incremental diff
         id: diff
         run: |

.github/workflows/build_wheels.yml

@@ -24,14 +24,14 @@ jobs:
       fail-fast: false
     steps:
       # Step 1: Checkout the code
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 2
           ssh-key: ${{ secrets.DEPLOY_KEY }}
           ref: ${{ github.ref_name }}
 
       # Step 2: Set up Python
-      - uses: actions/setup-python@v3
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
 
       # Step 3: Check if VERSION file has changed in this push
       - name: Check if VERSION file has changed
@@ -41,13 +41,13 @@ jobs:
           git config --global user.email "mlcommons-bot@users.noreply.github.com"
           if git diff --name-only $(git merge-base HEAD HEAD~1) | grep -q "VERSION"; then
             echo "VERSION file has been modified"
-            echo "::set-output name=version_changed::true"
+            echo "version_changed=true" >> "$GITHUB_OUTPUT"
             new_version=$(cat VERSION)
           else
             echo "VERSION file has NOT been modified"
-            echo "::set-output name=version_changed::false"
+            echo "version_changed=false" >> "$GITHUB_OUTPUT"
           fi
-          echo "::set-output name=new_version::$new_version"
+          echo "new_version=$new_version" >> "$GITHUB_OUTPUT"
 
       # Step 4: Increment version if VERSION was not changed
       - name: Increment version if necessary
@@ -65,7 +65,7 @@ jobs:
           new_version="$major.$minor.$patch"
           echo $new_version > VERSION
           echo "New version: $new_version"
-          echo "::set-output name=new_version::$new_version"
+          echo "new_version=$new_version" >> "$GITHUB_OUTPUT"
 
       # Step 5: Commit the updated version to the repository
       - name: Commit updated version
@@ -87,7 +87,7 @@ jobs:
 
       # Step 8: Publish to PyPI
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           verify-metadata: true
           skip-existing: true

.github/workflows/cla.yml

@@ -17,7 +17,7 @@ jobs:
       - name: "MLCommons CLA bot check"
         if: (github.event.comment.body == 'recheck') || github.event_name == 'pull_request_target'
         # Alpha Release
-        uses: mlcommons/cla-bot@master
+        uses: mlcommons/cla-bot@7facd19917cdb24be27bd8d266b41094506a0fb2 # master 2026-03-24
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # the below token should have repo scope and must be manually added by you in the repository's secret
@@ -26,7 +26,7 @@ jobs:
           path-to-signatures: 'cla-bot/v1/cla.json'
           # branch should not be protected
           branch: 'main'
-          allowlist: user1,bot*
+          allowlist: user1,mlcommons-bot,mlc-automations,bot*,copilot-swe-agent[bot],Copilot*
           remote-organization-name: mlcommons
           remote-repository-name: systems
 

.github/workflows/codeql.yml

@@ -19,6 +19,8 @@ on:
   schedule:
     - cron: '43 6 * * 0'
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -57,7 +59,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -67,7 +69,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3.35.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -95,6 +97,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3.35.1
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/format.yml

@@ -0,0 +1,60 @@
+# Automatic code formatting
+name: "Code formatting"
+on:
+  push:
+    branches:
+      - "**"
+
+env:
+  python_version: "3.9"
+
+jobs:
+  format-code:
+    if: github.actor != 'mlc-automations'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.MLC_AUTOMATIONS_APP_ID }}
+          private-key: ${{ secrets.MLC_AUTOMATIONS_PRIVATE_KEY }}
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Set up Python ${{ env.python_version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.python_version }}
+
+      - name: Format modified Python files
+        env:
+          filter: ${{ github.event.before }}
+        run: |
+          python3 -m pip install autopep8
+          for FILE in $(git diff --name-only $filter | grep -E '.*\.py$')
+          do
+            # Check if the file still exists in the working tree
+            if [ -f "$FILE" ]; then
+              autopep8 --in-place -a "$FILE"
+              git add "$FILE"
+            fi
+          done
+
+      - name: Commit and push changes
+        run: |
+          HAS_CHANGES=$(git diff --staged --name-only)
+          if [ ${#HAS_CHANGES} -gt 0 ]; then
+            # Use the GitHub actor's name and email
+            git config --global user.name mlc-automations
+            git config --global user.email "3246381+mlc-automations@users.noreply.github.com"
+            # Commit changes
+            git commit -m '[Automated Commit] Format Codebase'
+            git push 
+          fi

.github/workflows/mlperf-inference-bert.yml

@@ -28,9 +28,9 @@ jobs:
           - os: windows-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install mlcflow

.github/workflows/mlperf-inference-resnet50.yml

@@ -28,11 +28,11 @@ jobs:
             python-version: 3.13
     runs-on: "${{ matrix.on }}"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
 

.github/workflows/publish.yml

@@ -17,10 +17,10 @@ jobs:
 
     steps:
       - name: Checkout repository normally
-        uses: actions/checkout@v3
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.11"
 

.github/workflows/reset-fork.yml

@@ -8,13 +8,16 @@ on:
         required: false
         default: ''
 
+permissions:
+  contents: write
+
 jobs:
   reset-branch:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
@@ -24,7 +27,9 @@ jobs:
 
       - name: Use Input Branch
         if: ${{ inputs.branch != '' }}
-        run: echo "branch=${{ inputs.branch }}" >> $GITHUB_ENV
+        env:
+          BRANCH_INPUT: ${{ inputs.branch }}
+        run: echo "branch=${BRANCH_INPUT}" >> $GITHUB_ENV
 
       - name: Add Upstream Remote
         run: |