From 554f0ed00723d5cf7b675fbe99de87d5058d5a0b Mon Sep 17 00:00:00 2001 From: Matt Hughes Date: Wed, 14 Oct 2026 19:10:09 +0000 Subject: [PATCH 1/2] [docs] Regenerate sphinx requirements to clear trivy findings docs/sphinx/requirements.txt had drifted far enough behind its pip-compile inputs that trivy reported 83 vulnerabilities (47 HIGH, 2 CRITICAL) against it, all in transitive pins: gitpython 3.1.43, tornado 6.5, pyjwt 2.8.0, urllib3 2.6.0, cryptography 42.0.7, soupsieve 2.5 and jupyter-core 5.7.2. requirements.in only constrains rocm-docs-core (tracked as a git branch ref), so the fix is a straight recompile rather than a hand-edit: uv pip compile requirements.in --python-version 3.10 --upgrade \ --output-file requirements.txt Verified with trivy 0.70.0 (the version the security baseline pins): 0 findings at every severity, down from 83. Verified the docs still build and render identically: sphinx builds with both the old and new pin sets produce the same 20 pages and the same 36 warnings, and the extracted article text of index.html, install/build_from_source.html and reference/presets.html is character-for-character identical between the two builds. Co-authored-by: Pi Agent --- docs/sphinx/requirements.txt | 173 ++++++++++++++++++----------------- 1 file changed, 88 insertions(+), 85 deletions(-) diff --git a/docs/sphinx/requirements.txt b/docs/sphinx/requirements.txt index 9490a892..47182f65 100644 --- a/docs/sphinx/requirements.txt +++ b/docs/sphinx/requirements.txt @@ -1,97 +1,94 @@ # This file was autogenerated by uv via the following command: -# uv pip compile /home/pmoutsia/TransferBench/docs/sphinx/requirements.in --python-version 3.10 --output-file /home/pmoutsia/TransferBench/docs/sphinx/requirements.txt +# uv pip compile requirements.in --python-version 3.10 --output-file requirements.txt accessible-pygments==0.0.5 # via pydata-sphinx-theme -alabaster==0.7.16 +alabaster==1.0.0 # via sphinx -asttokens==3.0.0 +asttokens==3.0.2 # via stack-data -attrs==25.1.0 +attrs==26.1.0 # via # jsonschema # jupyter-cache # referencing -babel==2.15.0 +babel==2.18.0 # via # pydata-sphinx-theme # sphinx -beautifulsoup4==4.12.3 +beautifulsoup4==4.15.0 # via pydata-sphinx-theme -breathe==4.35.0 +breathe==5.1.0 # via rocm-docs-core -certifi==2024.2.2 +certifi==2026.7.22 # via requests -cffi==1.16.0 +cffi==2.1.1 # via # cryptography # pynacl -charset-normalizer==3.3.2 +charset-normalizer==3.5.2 # via requests -click==8.1.7 +click==8.5.0 # via # jupyter-cache # sphinx-external-toc -comm==0.2.2 +comm==0.2.3 # via ipykernel -cryptography==42.0.7 +cryptography==50.0.2 # via pyjwt -debugpy==1.8.12 +debugpy==1.8.22 # via ipykernel -decorator==5.1.1 +decorator==5.3.1 # via ipython -deprecated==1.2.14 - # via pygithub docutils==0.21.2 # via - # breathe # myst-parser # pydata-sphinx-theme # sphinx -exceptiongroup==1.2.2 +exceptiongroup==1.3.1 # via ipython -executing==2.2.0 +executing==2.3.0 # via stack-data -fastjsonschema==2.19.1 +fastjsonschema==2.22.2 # via # nbformat # rocm-docs-core -gitdb==4.0.11 +gitdb==4.0.12 # via gitpython -gitpython==3.1.43 +gitpython==3.2.1 # via rocm-docs-core -greenlet==3.1.1 +greenlet==3.5.6 # via sqlalchemy -idna==3.7 +idna==3.20 # via requests -imagesize==1.4.1 +imagesize==2.0.1 # via sphinx -importlib-metadata==8.6.1 +importlib-metadata==9.0.1 # via # jupyter-cache # myst-nb -ipykernel==6.29.5 +ipykernel==7.3.0 # via myst-nb -ipython==8.31.0 +ipython==8.39.0 # via # ipykernel # myst-nb -jedi==0.19.2 +jedi==0.20.1 # via ipython -jinja2==3.1.4 +jinja2==3.1.6 # via # myst-parser # sphinx -jsonschema==4.23.0 +jsonschema==4.26.0 # via nbformat -jsonschema-specifications==2024.10.1 +jsonschema-specifications==2025.9.1 # via jsonschema jupyter-cache==1.0.1 # via myst-nb -jupyter-client==8.6.3 +jupyter-client==8.10.0 # via # ipykernel # nbclient -jupyter-core==5.7.2 +jupyter-core==5.9.1 # via # ipykernel # jupyter-client @@ -101,104 +98,105 @@ markdown-it-py==3.0.0 # via # mdit-py-plugins # myst-parser -markupsafe==2.1.5 +markupsafe==3.0.4 # via jinja2 -matplotlib-inline==0.1.7 +matplotlib-inline==0.2.2 # via # ipykernel # ipython -mdit-py-plugins==0.4.1 +mdit-py-plugins==0.6.1 # via myst-parser mdurl==0.1.2 # via markdown-it-py -myst-nb==1.1.2 +myst-nb==1.4.0 # via rocm-docs-core -myst-parser==3.0.1 +myst-parser==4.0.1 # via myst-nb -nbclient==0.10.2 +nbclient==0.11.0 # via # jupyter-cache # myst-nb -nbformat==5.10.4 +nbformat==5.11.1 # via # jupyter-cache # myst-nb # nbclient -nest-asyncio==1.6.0 +nest-asyncio2==1.7.4 # via ipykernel -packaging==24.0 +packaging==26.3 # via # ipykernel # pydata-sphinx-theme # sphinx -parso==0.8.4 +parso==0.8.7 # via jedi pexpect==4.9.0 # via ipython -platformdirs==4.3.6 +platformdirs==4.12.4 # via jupyter-core -prompt-toolkit==3.0.50 +prompt-toolkit==3.0.53 # via ipython -psutil==6.1.1 +psutil==7.2.2 # via ipykernel ptyprocess==0.7.0 # via pexpect -pure-eval==0.2.3 +pure-eval==0.2.4 # via stack-data -pycparser==2.22 +pycparser==3.11 # via cffi pydata-sphinx-theme==0.15.4 # via # rocm-docs-core # sphinx-book-theme -pygithub==2.3.0 +pygithub==2.10.0 # via rocm-docs-core -pygments==2.18.0 +pygments==2.21.0 # via # accessible-pygments # ipython # pydata-sphinx-theme # sphinx -pyjwt==2.8.0 +pyjwt==2.15.1 # via pygithub -pynacl==1.5.0 +pynacl==1.6.2 # via pygithub python-dateutil==2.9.0.post0 # via jupyter-client -pyyaml==6.0.1 +pyyaml==6.0.3 # via # jupyter-cache # myst-nb # myst-parser # rocm-docs-core # sphinx-external-toc -pyzmq==26.2.1 +pyzmq==27.2.0 # via # ipykernel # jupyter-client -referencing==0.36.2 +referencing==0.37.0 # via # jsonschema # jsonschema-specifications -requests==2.32.2 +requests==2.34.2 # via # pygithub + # rocm-docs-core # sphinx -rocm-docs-core @ git+https://github.com/ROCm/rocm-docs-core.git@develop - # via -r TransferBench/docs/sphinx/requirements.in -rpds-py==0.22.3 +rocm-docs-core @ git+https://github.com/ROCm/rocm-docs-core.git@268254f585eb40b6f53a9d97318a4890a4b3d7f3 + # via -r requirements.in +rpds-py==0.30.0 # via # jsonschema # referencing six==1.17.0 # via python-dateutil -smmap==5.0.1 +smmap==5.0.3 # via gitdb -snowballstemmer==2.2.0 +snowballstemmer==3.1.1 # via sphinx -soupsieve==2.5 +soupsieve==2.10 # via beautifulsoup4 -sphinx==7.3.7 +sphinx==8.1.3 # via # breathe # myst-nb @@ -209,44 +207,46 @@ sphinx==7.3.7 # sphinx-copybutton # sphinx-design # sphinx-external-toc + # sphinx-multitoc-numbering # sphinx-notfound-page sphinx-book-theme==1.1.4 # via rocm-docs-core sphinx-copybutton==0.5.2 # via rocm-docs-core -sphinx-design==0.6.0 +sphinx-design==0.6.1 # via rocm-docs-core -sphinx-external-toc==1.0.1 +sphinx-external-toc==1.1.0 # via rocm-docs-core -sphinx-notfound-page==1.0.2 +sphinx-multitoc-numbering==0.1.3 + # via sphinx-external-toc +sphinx-notfound-page==1.1.0 # via rocm-docs-core -sphinxcontrib-applehelp==1.0.8 +sphinxcontrib-applehelp==2.0.0 # via sphinx -sphinxcontrib-devhelp==1.0.6 +sphinxcontrib-devhelp==2.0.0 # via sphinx -sphinxcontrib-htmlhelp==2.0.5 +sphinxcontrib-htmlhelp==2.1.0 # via sphinx sphinxcontrib-jsmath==1.0.1 # via sphinx -sphinxcontrib-qthelp==1.0.7 +sphinxcontrib-qthelp==2.0.0 # via sphinx -sphinxcontrib-serializinghtml==1.1.10 +sphinxcontrib-serializinghtml==2.0.0 # via sphinx -sqlalchemy==2.0.37 +sqlalchemy==2.0.54 # via jupyter-cache stack-data==0.6.3 # via ipython -tabulate==0.9.0 +tabulate==0.10.0 # via jupyter-cache -tomli==2.0.1 +tomli==2.5.0 # via sphinx -tornado==6.5 +tornado==6.5.10 # via # ipykernel # jupyter-client -traitlets==5.14.3 +traitlets==5.16.1 # via - # comm # ipykernel # ipython # jupyter-client @@ -254,21 +254,24 @@ traitlets==5.14.3 # matplotlib-inline # nbclient # nbformat -typing-extensions==4.11.0 +typing-extensions==4.16.0 # via + # beautifulsoup4 + # cryptography + # exceptiongroup # ipython + # jupyter-client # myst-nb # pydata-sphinx-theme # pygithub + # pyjwt # referencing # sqlalchemy -urllib3==2.6.0 +urllib3==2.8.0 # via # pygithub # requests -wcwidth==0.2.13 +wcwidth==0.9.2 # via prompt-toolkit -wrapt==1.16.0 - # via deprecated -zipp==3.21.0 +zipp==4.1.1 # via importlib-metadata From df3e0420b25ccd4e9198f00e73040338546105c5 Mon Sep 17 00:00:00 2001 From: Matt Hughes Date: Wed, 14 Oct 2026 19:21:06 +0000 Subject: [PATCH 2/2] [ci] Pin actions and images, scope OIDC permission to jobs that use it zizmor 1.30.0 (the version the ROCm security baseline pins) reports 13 findings at HIGH against the two existing workflows, which is enough to fail the security-scan gate that ROCm/TransferBench#360 introduces: 10x unpinned-uses build-relocatable-packages.yml, codeql.yml 2x unpinned-images build-relocatable-packages.yml, codeql.yml 1x excessive-permissions build-relocatable-packages.yml unpinned-uses / unpinned-images: every action is pinned to the commit SHA its current major tag resolves to, with the resolved version in a trailing comment, and both container images are pinned by digest. The major versions are deliberately unchanged (checkout stays on v4, not v7), so behaviour is identical and the upgrades are left to dependabot once the github-actions ecosystem is enabled. excessive-permissions: id-token: write was set at workflow level for the OIDC S3 upload, which also handed an OIDC-minting token to the release-summary job that only writes a step summary and uploads a markdown file. Moved to the two build jobs that run aws-actions/configure-aws-credentials. Verified: zizmor drops from 13 HIGH to 0 HIGH; actionlint reports the same 5 pre-existing shellcheck style findings before and after; all four action SHAs were confirmed to be the commit their version comment names, and both image digests return HTTP 200 from their registries. The 3 remaining MEDIUM artipacked findings (checkout without persist-credentials: false) are left alone - they are below the gate's HIGH threshold and are a separate change. Co-authored-by: Pi Agent --- .../workflows/build-relocatable-packages.yml | 24 ++++++++++++------- .github/workflows/codeql.yml | 8 +++---- 2 files changed, 19 insertions(+), 13 deletions(-) diff --git a/.github/workflows/build-relocatable-packages.yml b/.github/workflows/build-relocatable-packages.yml index 8a139f0d..825b21f5 100644 --- a/.github/workflows/build-relocatable-packages.yml +++ b/.github/workflows/build-relocatable-packages.yml @@ -28,7 +28,6 @@ on: permissions: contents: read - id-token: write # Required for OIDC S3 upload env: ROCM_VERSION: ${{ github.event.inputs.rocm_version || '' }} @@ -42,9 +41,12 @@ jobs: build-ubuntu: name: Build (Ubuntu 22.04) runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-22.04' }} + permissions: + contents: read + id-token: write # Required for OIDC S3 upload steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: recursive fetch-depth: 0 # for branch.commit version tags @@ -76,7 +78,7 @@ jobs: - name: Upload artifacts if: github.ref_name != 'candidate' && github.base_ref != 'candidate' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: ubuntu-22.04-packages path: | @@ -86,7 +88,7 @@ jobs: - name: Configure AWS credentials (OIDC) if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != '' && github.ref_name != 'candidate' && github.base_ref != 'candidate' - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN }} aws-region: us-east-1 @@ -149,11 +151,15 @@ jobs: build-manylinux: name: Build (manylinux_2_28) runs-on: ${{ vars.RUNNER_LABEL_CONTAINER || 'ubuntu-latest' }} + permissions: + contents: read + id-token: write # Required for OIDC S3 upload container: - image: quay.io/pypa/manylinux_2_28_x86_64 + # Pinned by digest; the floating tag is retained for readability. + image: quay.io/pypa/manylinux_2_28_x86_64:latest@sha256:4131ddd7acb9c6c966af02fe7e71edc51e078c2d41f475966697676430bfa2ae steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: recursive fetch-depth: 0 @@ -186,7 +192,7 @@ jobs: - name: Upload artifacts if: github.ref_name != 'candidate' && github.base_ref != 'candidate' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: manylinux_2_28-packages path: | @@ -202,7 +208,7 @@ jobs: - name: Configure AWS credentials (OIDC) if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != '' && github.ref_name != 'candidate' && github.base_ref != 'candidate' - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ secrets.AWS_ROLE_ARN }} aws-region: us-east-1 @@ -298,7 +304,7 @@ jobs: - name: Upload report if: github.ref_name != 'candidate' && github.base_ref != 'candidate' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: build-report path: report/build-report.md diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fdcd5276..f88d45b8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,7 +19,7 @@ jobs: analyze: name: Analyze (C/C++) runs-on: ubuntu-latest - container: rocm/dev-ubuntu-22.04:latest + container: rocm/dev-ubuntu-22.04:latest@sha256:6c11663a93966c040cd56dc73ed6d6761cdb887068f3f8940c4d3fe4e6829f10 # 10.1.0-full permissions: security-events: write packages: read @@ -34,7 +34,7 @@ jobs: DEBIAN_FRONTEND=noninteractive apt-get install -y git - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Configure Git Safe Directory run: | @@ -46,7 +46,7 @@ jobs: apt-get install -y build-essential cmake libnuma-dev - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@9f759ee644a3e7c15c1390abf49868036c00067b # v3.38.3 with: languages: c-cpp build-mode: manual @@ -64,6 +64,6 @@ jobs: make -j $(nproc) - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@9f759ee644a3e7c15c1390abf49868036c00067b # v3.38.3 with: category: "/language:c-cpp"