Merge microsoft/onnxruntime

.clang-format

@@ -7,6 +7,9 @@ BasedOnStyle:  Google
 ColumnLimit:     0
 SortIncludes: false
 DerivePointerAlignment: false
+# Avoid adding spaces between tokens in GSL_SUPPRESS arguments.
+# E.g., don't change "GSL_SUPPRESS(r.11)" to "GSL_SUPPRESS(r .11)".
+WhitespaceSensitiveMacros: ["GSL_SUPPRESS"]
 
 # if you want to customize when working locally see https://clang.llvm.org/docs/ClangFormatStyleOptions.html for options.
 # See ReformatSource.ps1 for a script to update all source according to the current options in this file.
@@ -19,4 +22,3 @@ DerivePointerAlignment: false
 # NamespaceIndentation: All
 
 ...
-

.gdn/.gdntsa

@@ -1,3 +1,3 @@
 {
-    "codebaseName": "onnxruntime_master"
+    "codebaseName": "onnxruntime_main"
 }

.github/ISSUE_TEMPLATE/04-web.yml

@@ -55,8 +55,10 @@ body:
     attributes:
       label: Execution Provider
       options:
-        - WebGL
-        - WASM
+        - "'webgl' (WebGL)"
+        - "'wasm'/'cpu' (WebAssembly CPU)"
+        - "'xnnpack' (WebAssembly XNNPACK)"
+        - "'webgpu' (WebGPU)"
         - Other / Unknown
       multiple: yes
     validations:

.github/dependabot.yml

@@ -0,0 +1,20 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "pip" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "github-actions"
+    # Workflow files stored in the
+    # default location of `.github/workflows`
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

.github/labeler.yml

@@ -14,7 +14,7 @@ ep:tvm: '/\btvm\b/i'
 ep:VitisAI: '/\bvitis(?:ai)?\b/i'
 platform:jetson: '/\bjetson\b/i'
 platform:mobile: '/(\bobj(?:ective)?-?c\b|\bnnapi\b|\bcore-?ml\b|\bmobile\b|\bandroid\b|\bios\b|\bxamarin\b|\bmaui\b)/i'
-platform:web: '/(\bwebgl\b|\bwasm\b)/i'
+platform:web: '/(\bwebgl\b|\bweb-?gpu\b|\bwasm\b|\bonnxruntime-node\b|\bonnxruntime-web\b)/i'
 platform:windows: '/(\bwindows\b|\bwinrt\b|\bwinml\b)/i'
 model:transformer: '/(\bbert\b|\bgpt-?2\b|\bhugging-?face\b|\blong-?former\b|\bt5\b)/i'
 quantization: '/(is this a quantized model\?\n\nYes|\bquantization\b)/i'

.github/workflows/cffconvert.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out a copy of the repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Check whether the citation metadata from CITATION.cff is valid
         uses: citation-file-format/[email protected]

.github/workflows/codeql.yml

@@ -33,11 +33,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -47,11 +47,19 @@ jobs:
         # Details on CodeQL's query packs refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         queries: security-extended,security-and-quality
 
+    # Setup Java to use a version that is not too old for the project
+    - if: ${{ matrix.language == 'java' }}
+      name: Setup Java 11
+      uses: actions/setup-java@v4
+      with:
+        java-version: '11'
+        distribution: 'microsoft'
+
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - if: ${{ matrix.language != 'cpp' }}
       name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

.github/workflows/generate-skip-doc-change.py

@@ -7,7 +7,7 @@
 GITHUB_DIR = Path(__file__).resolve().parent.parent
 
 
-class Skipped_Workflow:
+class Skipped_Workflow:  # noqa: N801
     def __init__(self, workflow_name: str, job_names: list, output_file_name: str):
         self.workflow_name = workflow_name
         self.job_names = job_names

.github/workflows/gradle-wrapper-validation.yml

@@ -0,0 +1,14 @@
+# Check gradle-wrapper.jar checksums against official Gradle releases.
+# See: https://github.com/marketplace/actions/gradle-wrapper-validation
+# This workflow was copied from the link above.
+
+name: "Validate Gradle Wrapper"
+on: [push, pull_request]
+
+jobs:
+  validation:
+    name: "Validation"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: gradle/wrapper-validation-action@v2

.github/workflows/labeler.yml

@@ -3,11 +3,14 @@ on:
   issues:
     types: [opened, edited]
 
+permissions:
+  issues: write
+
 jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
-    - uses: github/issue-labeler@v2.5
+    - uses: github/issue-labeler@v3.4
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         configuration-path: .github/labeler.yml

.github/workflows/lint.yml

@@ -3,32 +3,16 @@ name: Lint
 on:
   push:
     branches:
-      - master
       - main
+      - rel-*
   pull_request:
 
 jobs:
-  lint-python:
-    name: Lint Python
+  optional-lint:
+    name: Optional Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - name: flake8
-        uses: reviewdog/action-flake8@v3
-        with:
-          github_token: ${{ secrets.github_token }}
-          # Change reviewdog reporter if you need [github-pr-check, github-check, github-pr-review].
-          reporter: github-pr-check
-          # Change reporter level if you need.
-          # GitHub Status Check won't become failure with a warning.
-          level: error
-          filter_mode: file
-      - name: pyflakes
-        uses: reviewdog/action-pyflakes@v1
-        with:
-          github_token: ${{ secrets.github_token }}
-          reporter: github-pr-check
-          level: warning
+      - uses: actions/checkout@v4
       - name: misspell # Check spellings as well
         uses: reviewdog/action-misspell@v1
         with:
@@ -44,43 +28,49 @@ jobs:
           reporter: github-pr-check
           level: info
           filter_mode: file
-      - name: pyright
-        uses: jordemort/action-pyright@v1
-        with:
-          github_token: ${{ secrets.github_token }}
-          reporter: github-pr-check
-          level: warning
-          filter_mode: added
-          lib: true
-          pyright_version: 1.1.291
-      - name: pylint
-        uses: dciborow/[email protected]
-        with:
-          github_token: ${{ secrets.github_token }}
-          reporter: github-pr-check
-          level: warning
-          filter_mode: diff_context
-          glob_pattern: "**/*.py"
 
   lint-python-format:
-    # Separated black/isort from other Python linters because we want this job to
-    # fail and not affect other linters
-    # According to https://black.readthedocs.io/en/stable/integrations/github_actions.html:
-    #     We recommend the use of the @stable tag, but per version tags also exist if you prefer that.
-    #     Note that the action’s version you select is independent of the version of Black the action will use.
-    #     The version of Black the action will use can be configured via version.
+    # Required workflow
     name: Python format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: actions/setup-python@v5
         with:
+          # Version range or exact version of Python to use, using SemVer's version range syntax. Reads from .python-version if unset.
           python-version: "3.10"
-      - uses: psf/black@stable
+      - name: Setup Rust
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+          components: rustfmt
+      - name: Install dependencies
+        run: |
+          python -m pip install -r requirements-dev.txt
+          python -m pip install lintrunner lintrunner-adapters
+          lintrunner init
+      - name: Run lintrunner on all files
+        run: |
+          set +e
+          if ! lintrunner --force-color --all-files --tee-json=lint.json -v; then
+              echo ""
+              echo -e "\e[1m\e[36mYou can reproduce these results locally by using \`lintrunner\`. To set up lintrunner locally, see https://github.com/microsoft/onnxruntime/blob/main/docs/Coding_Conventions_and_Standards.md#linting .\e[0m"
+              exit 1
+          fi
+      - name: Produce SARIF
+        if: always()
+        run: |
+          python -m lintrunner_adapters to-sarif lint.json lintrunner.sarif
+      - name: Upload SARIF file
+        if: always()
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@v3
         with:
-          options: "--check --diff --color"
-          version: "22.12.0"
-      - uses: isort/isort-action@master
+          # Path to SARIF file relative to the root of the repository
+          sarif_file: lintrunner.sarif
+          category: lintrunner
+          checkout_path: ${{ github.workspace }}
 
   lint-cpp:
     name: Lint C++
@@ -98,13 +88,6 @@ jobs:
             --cmake_extra_defines CMAKE_EXPORT_COMPILE_COMMANDS=ON
       - name: Generate ONNX protobuf files
         run: cmake --build build/Debug --config Debug --target onnx_proto
-#       - name: Run clang-tidy
-#         uses: ZedThree/clang-tidy-review@526cbfb043719639f1ebdeedae0cc1eacd219d8f
-#         with:
-#           token: ${{ secrets.github_token }}
-#           build_dir: "build/Debug"
-#           config_file: ".clang-tidy"
-#           lgtm_comment_body: ""
       - uses: reviewdog/action-cpplint@master
         with:
           github_token: ${{ secrets.github_token }}
@@ -117,7 +100,7 @@ jobs:
     name: Lint JavaScript
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - uses: reviewdog/action-eslint@v1
         with:
           reporter: github-pr-check