feat(rocke): grouped convolution benchmarks #4889
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Libraries PR Bot | |
| on: | |
| workflow_dispatch: | |
| # SECURITY: pull_request_target runs in the BASE-repo context, so secrets and | |
| # a write token are available even for PRs opened from FORKS. | |
| # | |
| # This is SAFE here ONLY because this workflow: | |
| # • NEVER checks out or executes PR head code (see checkout step below), | |
| # • runs the TRUSTED policy_check.py / policy.yml from the base branch, and | |
| # • reads all PR data via the GitHub API. | |
| # Do NOT add build/test/install steps that run PR-provided code, and do NOT | |
| # change the checkout to the PR head — that would create a "pwn request". | |
| # Refs: | |
| # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target | |
| # https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/ | |
| pull_request_target: | |
| branches: [develop, pr-bot-test] | |
| types: [opened, synchronize, reopened, ready_for_review, edited] | |
| # Least privilege. Writes are needed to post the results comment and manage the | |
| # "Not ready to Review" label; everything else stays read-only. | |
| permissions: | |
| contents: read | |
| pull-requests: write # post / update the policy results table comment | |
| issues: write # add / remove the "Not ready to Review" label | |
| checks: read | |
| # Avoid two runs racing on the same PR's comment/label (e.g. fast pushes). | |
| concurrency: | |
| group: therock-pr-bot-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| policy: | |
| name: therock-pr-bot | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| # SECURITY: check out the TRUSTED base commit, NEVER the PR head. This | |
| # guarantees we run OUR policy_check.py / policy.yml — not the fork's. | |
| # `persist-credentials: false` follows the safer-checkout defaults | |
| # (https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/). | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Detect GitHub App secrets | |
| id: app-secrets | |
| shell: bash | |
| env: | |
| APP_ID: ${{ secrets.THEROCK_PR_BOT_APPID }} | |
| APP_KEY: ${{ secrets.THEROCK_PRBOT_KEY }} | |
| run: | | |
| if [[ -n "$APP_ID" && -n "$APP_KEY" ]]; then | |
| echo "available=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "available=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Create GitHub App token | |
| id: app-token | |
| if: steps.app-secrets.outputs.available == 'true' | |
| uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0 | |
| with: | |
| app-id: ${{ secrets.THEROCK_PR_BOT_APPID }} | |
| private-key: ${{ secrets.THEROCK_PRBOT_KEY }} | |
| # SECURITY: only fixed, trusted dependencies — never installed from the PR. | |
| - name: Install deps | |
| run: python -m pip install --upgrade pip requests pyyaml | |
| - name: Enforce policy | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }} | |
| HAS_GITHUB_APP_TOKEN: ${{ steps.app-secrets.outputs.available }} | |
| POST_COMMENTS: ${{ steps.app-secrets.outputs.available }} | |
| MUTATE_PR: ${{ steps.app-secrets.outputs.available }} | |
| OWNER: ${{ github.repository_owner }} | |
| REPO: ${{ github.event.repository.name }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| SHA: ${{ github.event.pull_request.head.sha }} | |
| run: python tools/libraries_pr_bot/policy_check.py --timeout-seconds 900 --poll-seconds 15 |