Skip to content

Bump the github-actions group with 5 updates #327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Bump the github-actions group with 5 updates #327

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
f9b7c18
GSD-13566 Clarify that Metrics APIs do not support Counter Based Even…
leonardo-intel Oct 5, 2026
4ca5fce
Add CodeQL scan of Python scripts and workflows (#553)
rwmcguir Oct 5, 2026
538e468
Add Power of 2 enforcement for memory fill funtions (#549)
rwmcguir Oct 6, 2026
be8ab05
Drop unused LOADER_INNERSOURCE_TOKEN from workflows (#555)
rwmcguir Oct 6, 2026
bdf6e4e
Bump the github-actions group with 4 updates (#552)
dependabot[bot] Oct 6, 2026
0c29bae
Revert "feature: Enable driver level device pci properties (#547)" (#…
shubskmr Oct 7, 2026
5e1ddde
Fail the docs build on Sphinx warnings and post them to the PR (#556)
rwmcguir Oct 7, 2026
90beb9e
Bump actions/checkout (#558)
dependabot[bot] Oct 7, 2026
3ce801d
Bump the github-actions group with 5 updates
dependabot[bot] Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions .github/workflows/build-quick-static-n-1.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
steps:
# ----- Spec-generated loader preamble (loader-head, see loader-integration.yml) -----
- name: Checkout spec-head
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
clean: true
fetch-depth: 0
Expand Down Expand Up @@ -66,13 +66,12 @@ jobs:
ghcr.io/oneapi-src/spec-build:latest \
/opt/spec-venv/bin/python3 ./run.py --debug '--!html' '--!rst' '--!build' --ver $VER
- name: Checkout loader-head
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
clean: true
repository: oneapi-src/level-zero
ref: master
path: loader-head
token: ${{ secrets.LOADER_INNERSOURCE_TOKEN }}
- name: json2src head
run: | #bash
docker run \
Expand All @@ -92,13 +91,12 @@ jobs:
xargs -I{} cp -v ./{} ../loader-head/{}
# ----- loader-base: plain loader master, built as-is (n-1 / static side) -----
- name: Checkout loader-base
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
clean: true
repository: oneapi-src/level-zero
ref: master
path: loader-base
token: ${{ secrets.LOADER_INNERSOURCE_TOKEN }}
# ----- Re-created build-quick-static-n-1 logic -----
- name: Build static loader from loader master
working-directory: loader-base
Expand Down
5 changes: 2 additions & 3 deletions .github/workflows/build-quick-static.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:
steps:
# ----- Spec-generated loader preamble (see loader-integration.yml) -----
- name: Checkout spec-head
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
clean: true
fetch-depth: 0
Expand Down Expand Up @@ -65,13 +65,12 @@ jobs:
ghcr.io/oneapi-src/spec-build:latest \
/opt/spec-venv/bin/python3 ./run.py --debug '--!html' '--!rst' '--!build' --ver $VER
- name: Checkout loader-head
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
clean: true
repository: oneapi-src/level-zero
ref: master
path: loader-head
token: ${{ secrets.LOADER_INNERSOURCE_TOKEN }}
- name: json2src head
run: | #bash
docker run \
Expand Down
5 changes: 2 additions & 3 deletions .github/workflows/build-quick.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ jobs:
steps:
# ----- Spec-generated loader preamble (see loader-integration.yml) -----
- name: Checkout spec-head
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
clean: true
fetch-depth: 0
Expand Down Expand Up @@ -85,13 +85,12 @@ jobs:
ghcr.io/oneapi-src/spec-build:latest \
/opt/spec-venv/bin/python3 ./run.py --debug '--!html' '--!rst' '--!build' --ver $VER
- name: Checkout loader-head
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
clean: true
repository: oneapi-src/level-zero
ref: master
path: loader-head
token: ${{ secrets.LOADER_INNERSOURCE_TOKEN }}
- name: json2src head
run: | #bash
docker run \
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/cleanup-pr-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
if: github.repository_owner == 'intel-innersource'
steps:
- name: Checkout gh-pages branch
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: gh-pages
path: gh-pages-repo
Expand Down
46 changes: 46 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
name: CodeQL

# Static analysis (SAST) of the Python generator scripts and the workflow files.
# Results go to the public repo's Security > Code scanning tab. Runs only on the
# public repo, like scorecard.yml; internal mirrors block ubuntu-latest runners.
on:
# Allow manual runs from the Actions tab ("Run workflow" button).
workflow_dispatch:
push:
branches: [ "master" ]
schedule:
- cron: '41 20 * * 4'

permissions:
contents: read

jobs:
analyze:
name: Analyze (${{ matrix.language }})
runs-on: ubuntu-latest
if: github.repository_owner == 'oneapi-src'
permissions:
# Needed to upload the results to code-scanning dashboard.
security-events: write
contents: read
strategy:
fail-fast: false
matrix:
language: [ "python", "actions" ]

steps:
- name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Initialize CodeQL
uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
with:
languages: ${{ matrix.language }}
build-mode: none

- name: Perform CodeQL analysis
uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
with:
category: "/language:${{ matrix.language }}"
4 changes: 2 additions & 2 deletions .github/workflows/codespell.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ jobs:
runs-on: [self-hosted, Linux]
if: github.repository_owner == 'intel-innersource'
steps:
- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Run codespell
# Configuration (skip/ignore lists) is picked up from .codespellrc. A spelling
# finding must not fail this step: the report has to be published to the PR
Expand Down Expand Up @@ -79,7 +79,7 @@ jobs:
}' codespell.txt
- name: Post or update PR comment
if: github.event_name == 'pull_request'
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const fs = require('fs');
Expand Down
154 changes: 62 additions & 92 deletions .github/workflows/deploy-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
if: github.repository_owner == 'intel-innersource'
steps:
- name: Checkout
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
clean: true
fetch-depth: 0
Expand Down Expand Up @@ -97,107 +97,77 @@ jobs:
ghcr.io/oneapi-src/spec-build:latest \
/opt/spec-venv/bin/python3 ./run.py --debug '--html' '--rst' '--!build' --ver $VER --versions_url_override "$VERSIONS_URL_OVERRIDE"

# Doxygen runs with WARN_AS_ERROR=FAIL_ON_WARNINGS (scripts/Doxyfile), so any
# unresolvable doc reference fails the build. generate_docs.py saves doxygen's
# stderr -- which is diagnostics only, no progress noise -- to this file, so we can
# quote just the actionable lines rather than the whole build log.
- name: Report documentation warnings
# Each docs build phase that can fail on bad references saves just its actionable
# lines to a log under docs/, so we quote those rather than the whole build log:
# - rst-errors.log: unresolved symbols in scripts/<section>/*.rst (run.py phase 3)
# - doxygen-warnings.log: doxygen runs with WARN_AS_ERROR=FAIL_ON_WARNINGS
# - sphinx-warnings.log: sphinx-build runs with -W, e.g. a broken :ref: label
- name: Report documentation errors
if: steps.gen_docs.outcome == 'failure'
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const fs = require('fs');
const path = 'docs/doxygen-warnings.log';
const reports = [
{
path: 'docs/rst-errors.log',
what: n => `Generation reported **${n}** unresolved ${n === 1 ? 'reference' : 'references'} in the spec RST/sample code`,
hint: '> These reference symbols that do not exist in the parsed spec. ' +
'Fix the reference in the source `scripts/<section>/*.rst` page ' +
'(or add the missing symbol to `scripts/<section>/*.yml`).\n',
},
{
path: 'docs/doxygen-warnings.log',
what: n => `Doxygen reported **${n}** unresolved documentation ${n === 1 ? 'reference' : 'references'}`,
hint: '> Line numbers refer to the **generated** headers. Fix the source ' +
'YAML in `scripts/<section>/*.yml` instead.\n' +
'> To reference a struct member write ``` `memberName` member of ' +
'$x_some_struct_t ``` rather than `$x_some_struct_t.memberName`.\n',
},
{
path: 'docs/sphinx-warnings.log',
what: n => `Sphinx reported **${n}** ${n === 1 ? 'warning' : 'warnings'}`,
hint: '> Paths refer to the **generated** `docs/source` pages. Fix the source ' +
'`scripts/<section>/*.rst` page or `scripts/templates/*.mako` template. ' +
'An `undefined label` usually means a `:ref:` target page is missing.\n',
},
];

if (!fs.existsSync(path) || !fs.readFileSync(path, 'utf8').trim()) {
core.info('No doxygen warning log; documentation generation failed for another reason.');
return;
}

// Strip the runner's absolute workspace prefix so paths read as repo-relative.
let lines = fs.readFileSync(path, 'utf8')
.split('\n')
.filter(l => l.trim())
.map(l => l.replace(`${process.env.GITHUB_WORKSPACE}/`, ''));

const total = lines.length;
const MAX = 50;
const shown = lines.slice(0, MAX);
const omitted = total - shown.length;
let posted = false;
for (const r of reports) {
if (!fs.existsSync(r.path) || !fs.readFileSync(r.path, 'utf8').trim()) continue;

let body = '## ❌ Documentation build failed\n\n';
body += `Doxygen reported **${total}** unresolved documentation `;
body += `${total === 1 ? 'reference' : 'references'}:\n\n`;
body += '```\n' + shown.join('\n') + '\n```\n';
if (omitted > 0) {
body += `\n_…and ${omitted} more. See the workflow log for the full list._\n`;
}
body += '\n> Line numbers refer to the **generated** headers. Fix the source ';
body += 'YAML in `scripts/<section>/*.yml` instead.\n';
body += '> To reference a struct member write ``` `memberName` member of ';
body += '$x_some_struct_t ``` rather than `$x_some_struct_t.memberName`.\n';
// Strip the runner's absolute workspace prefix so paths read as repo-relative.
const lines = fs.readFileSync(r.path, 'utf8')
.split('\n')
.filter(l => l.trim())
.map(l => l.replace(`${process.env.GITHUB_WORKSPACE}/`, ''));
const shown = lines.slice(0, MAX);
const omitted = lines.length - shown.length;

core.summary.addRaw(body).write();
let body = '## ❌ Documentation build failed\n\n';
body += `${r.what(lines.length)}:\n\n`;
body += '```\n' + shown.join('\n') + '\n```\n';
if (omitted > 0) {
body += `\n_…and ${omitted} more. See the workflow log for the full list._\n`;
}
body += '\n' + r.hint;

if (context.eventName === 'pull_request') {
await github.rest.issues.createComment({
issue_number: context.payload.pull_request.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: body
});
core.summary.addRaw(body).write();
if (context.eventName === 'pull_request') {
await github.rest.issues.createComment({
issue_number: context.payload.pull_request.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: body
});
}
posted = true;
}

# RST generation (generate_docs.py) resolves the symbols referenced in the
# hand-authored scripts/<section>/*.rst pages and sample code. An unresolved
# reference is collected via util.makeError and fails run.py in phase 3 -- before
# doxygen runs -- with the actionable lines saved to docs/rst-errors.log.
- name: Report reference errors
if: steps.gen_docs.outcome == 'failure'
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const fs = require('fs');
const path = 'docs/rst-errors.log';

if (!fs.existsSync(path) || !fs.readFileSync(path, 'utf8').trim()) {
core.info('No RST error log; documentation generation failed for another reason.');
return;
}

// Strip the runner's absolute workspace prefix so paths read as repo-relative.
let lines = fs.readFileSync(path, 'utf8')
.split('\n')
.filter(l => l.trim())
.map(l => l.replace(`${process.env.GITHUB_WORKSPACE}/`, ''));

const total = lines.length;
const MAX = 50;
const shown = lines.slice(0, MAX);
const omitted = total - shown.length;

let body = '## ❌ Documentation build failed\n\n';
body += `Generation reported **${total}** unresolved `;
body += `${total === 1 ? 'reference' : 'references'} in the spec RST/sample code:\n\n`;
body += '```\n' + shown.join('\n') + '\n```\n';
if (omitted > 0) {
body += `\n_…and ${omitted} more. See the workflow log for the full list._\n`;
}
body += '\n> These reference symbols that do not exist in the parsed spec. ';
body += 'Fix the reference in the source `scripts/<section>/*.rst` page ';
body += '(or add the missing symbol to `scripts/<section>/*.yml`).\n';

core.summary.addRaw(body).write();

if (context.eventName === 'pull_request') {
await github.rest.issues.createComment({
issue_number: context.payload.pull_request.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: body
});
if (!posted) {
core.info('No documentation error log; generation failed for another reason.');
}

- name: Fail if documentation generation failed
Expand Down Expand Up @@ -303,7 +273,7 @@ jobs:
echo "Prepared documentation in directory: $DIR_NAME"

- name: Checkout gh-pages branch
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: gh-pages
path: gh-pages-repo
Expand Down
Loading