onnxruntime/.github/workflows/linux_ci.yml at master · CodeLinaro/onnxruntime · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
# This workflow builds and tests the ONNX Runtime for Linux on multiple architectures and configurations.
# It leverages a reusable workflow (`reusable_linux_build.yml`) to handle the core build and test logic
# within Docker containers, ensuring a consistent environment.
#
# The workflow consists of five parallel jobs targeting different combinations:
#   - build-linux-x64-debug: Builds/tests Debug config on Linux x64 (AMD CPU pool), enables AddressSanitizer.
#   - build-linux-x64-release: Builds/tests Release config on Linux x64 (AMD CPU pool), includes wheel/nuget/benchmark flags.
#   - orttraining-linux-ci-pipeline: Builds/tests Release config with Training enabled (--enable_training) on Linux x64 (AMD CPU pool).
#   - build-linux-arm64-debug: Builds/tests Debug config on Linux arm64 (ARM CPU pool); ASan is disabled due to excessive runtime. Includes wheel build.
#   - build-linux-arm64-release: Builds/tests Release config on Linux arm64 (ARM CPU pool), includes wheel/benchmark flags.
#
# Each job calls the reusable workflow, passing specific parameters:
#   - target architecture (x64 or arm64)
#   - build configuration (Debug or Release)
#   - runner pool name
#   - path to the appropriate Dockerfile
#   - Docker image name for caching/use
#   - configuration-specific build flags (e.g., --enable_address_sanitizer, --enable_training, --build_wheel)

name: Linux CI

on:
  push:
    branches: [main, 'rel-*']
  pull_request:
    branches: [main, 'rel-*']
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write
  attestations: write
  id-token: write

jobs:
  # --- x64 Builds ---
  build-linux-x64-debug:
    name: Build Linux x64 Debug (ASan)
    uses: ./.github/workflows/reusable_linux_build.yml
    with:
      pool_name: "onnxruntime-github-Ubuntu2204-AMD-CPU"
      build_config: Debug
      architecture: x64
      dockerfile_path: tools/ci_build/github/linux/docker/inference/x86_64/default/cpu/Dockerfile
      docker_image_repo: onnxruntimecpubuildcix64
      extra_build_flags: '--enable_address_sanitizer'
      job_identifier: build-linux-x64-debug
      # python_path_prefix: '' # Default empty string is fine, no prefix needed
    secrets:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-linux-x64-release:
    name: Build Linux x64 Release
    uses: ./.github/workflows/reusable_linux_build.yml
    with:
      pool_name: "onnxruntime-github-Ubuntu2204-AMD-CPU"
      build_config: Release
      architecture: x64
      dockerfile_path: tools/ci_build/github/linux/docker/Dockerfile.manylinux2_28_cpu
      docker_image_repo: onnxruntimecpubuildpythonx64
      extra_build_flags: '--use_binskim_compliant_compile_flags --build_wheel --build_nuget --enable_transformers_tool_test --cmake_extra_defines onnxruntime_BUILD_BENCHMARKS=ON'
      python_path_prefix: 'PATH=/opt/python/cp310-cp310/bin:$PATH' # $ needs escaping in single quotes
      run_go_tests: true
      job_identifier: build-linux-x64-release
    secrets:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-linux-x64-release-py314:
    name: Build Linux x64 Release (Python 3.14)
    uses: ./.github/workflows/reusable_linux_build.yml
    with:
      pool_name: "onnxruntime-github-Ubuntu2204-AMD-CPU"
      build_config: Release
      architecture: x64
      dockerfile_path: tools/ci_build/github/linux/docker/Dockerfile.manylinux2_28_cpu
      docker_image_repo: onnxruntimecpubuildpythonx64
      # MATERIALIZE=ON needs no explicit pre-build pip install on this leg: the manylinux cp314
      # image already ships onnx==1.22.0 + numpy==2.4.2 (the exact gate pins) via its
      # requirements.txt (install_deps.sh installs it into cp311-cp314). Intentional, not an
      # omission -- unlike the QNN/android legs which run on bare agents and pip-install the pins.
      extra_build_flags: '--use_binskim_compliant_compile_flags --build_wheel --build_nuget --enable_transformers_tool_test --cmake_extra_defines onnxruntime_BUILD_BENCHMARKS=ON --cmake_extra_defines onnxruntime_MATERIALIZE_ONNX_NODE_TESTS=ON'
      python_path_prefix: 'PATH=/opt/python/cp314-cp314/bin:$PATH' # $ needs escaping in single quotes
      job_identifier: build-linux-x64-release-py314
    secrets:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  orttraining-linux-ci-pipeline:
    name: Build Linux x64 Release with training
    uses: ./.github/workflows/reusable_linux_build.yml
    with:
      pool_name: "onnxruntime-github-Ubuntu2204-AMD-CPU"
      build_config: Release
      architecture: x64
      dockerfile_path: tools/ci_build/github/linux/docker/Dockerfile.manylinux2_28_cpu
      docker_image_repo: onnxruntimecpubuildpythonx64 # Shares image with standard x64 release
      extra_build_flags: '--enable_training --use_binskim_compliant_compile_flags --build_wheel --build_nuget --enable_transformers_tool_test --cmake_extra_defines onnxruntime_BUILD_BENCHMARKS=ON'
      python_path_prefix: 'PATH=/opt/python/cp310-cp310/bin:$PATH' # $ needs escaping in single quotes
      job_identifier: orttraining-linux-ci-pipeline
    secrets:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # --- arm64 Builds ---
  build-linux-arm64-debug:
    name: Build Linux arm64 Debug
    uses: ./.github/workflows/reusable_linux_build.yml
    with:
      pool_name: "onnxruntime-github-Ubuntu2204-ARM-CPU"
      build_config: Debug
      architecture: arm64
      dockerfile_path: tools/ci_build/github/linux/docker/inference/aarch64/default/cpu/Dockerfile
      docker_image_repo: onnxruntimecpubuildciaarch64
      # ASan disabled due to excessive runtime (>4hr). Includes wheel build for basic checks.
      extra_build_flags: '--use_binskim_compliant_compile_flags --build_shared_lib --enable_arm_neon_nchwc'
      job_identifier: build-linux-arm64-debug
    secrets:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-linux-arm64-release:
    name: Build Linux arm64 Release
    uses: ./.github/workflows/reusable_linux_build.yml
    with:
      pool_name: "onnxruntime-github-Ubuntu2204-ARM-CPU"
      build_config: Release
      architecture: arm64
      dockerfile_path: tools/ci_build/github/linux/docker/inference/aarch64/python/cpu/Dockerfile
      docker_image_repo: onnxruntimecpubuildpythonaarch64
      extra_build_flags: '--use_binskim_compliant_compile_flags --build_wheel --cmake_extra_defines onnxruntime_BUILD_BENCHMARKS=ON'
      python_path_prefix: 'PATH=/opt/python/cp314-cp314/bin:$PATH' # $ needs escaping in single quotes
      job_identifier: build-linux-arm64-release
    secrets:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}