Merge branch 'main' into reconvergence-workflow

Author: luciechoi

.github/workflows/build-and-test-callable.yaml

@@ -106,45 +106,47 @@ on:
 
 jobs:
   build:
+    permissions:
+      checks: write
     runs-on: [self-hosted, "hlsl-${{ inputs.SKU }}"]
     steps:
       - name: Checkout DXC
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: Microsoft/DirectXShaderCompiler
           ref: ${{ inputs.DXC-branch }}
           path: DXC
           fetch-depth: 1
           submodules: true
       - name: Checkout LLVM
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: ${{ inputs.LLVM-fork }}/llvm-project
           ref: ${{ inputs.LLVM-branch }}
           path: llvm-project
           fetch-depth: 1
       - name: Checkout OffloadTest
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: llvm/offload-test-suite
           ref: ${{ inputs.OffloadTest-branch }}
           path: OffloadTest
           fetch-depth: 1
       - name: Checkout Golden Images
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: llvm/offload-golden-images
           ref: main
           path: golden-images
           fetch-depth: 1
       - name: Setup Windows x64
         if: inputs.OS == 'windows' && runner.arch != 'ARM64'
-        uses: llvm/actions/setup-windows@main
+        uses: llvm/actions/setup-windows@89a8cf80982d830faab019237860b344a6390c30 # main
         with:
           arch: amd64
       - name: Setup Windows
         if: inputs.OS == 'windows' && runner.arch == 'ARM64'
-        uses: llvm/actions/setup-windows@main
+        uses: llvm/actions/setup-windows@89a8cf80982d830faab019237860b344a6390c30 # main
         with:
           arch: arm64
       - name: Detect Clang
@@ -194,7 +196,7 @@ jobs:
             cd build
             ./bin/llvm-lit -v --xunit-xml-output=testresults-max-reconv.xunit.xml ${{ github.workspace }}/OffloadTest/tools/TestGenerator/reconvergence/tests
       - name: Publish Test Results
-        uses: EnricoMi/publish-unit-test-result-action/macos@v2
+        uses: EnricoMi/publish-unit-test-result-action/macos@34d7c956a59aed1bfebf31df77b8de55db9bbaaf # v2.21.0
         if: always() && inputs.OS == 'macOS'
         with:
           check_name: "HLSL Test Results"

.github/workflows/macos-clang-mtl.yaml

@@ -2,15 +2,20 @@ name: macOS Metal Clang
 
 permissions:
   contents: read
-  checks: write
 
 on:
   workflow_dispatch:
   schedule:
     - cron: '*/30 * * * *' # run every 30 minutes
+  pull_request:
+    paths:
+     - .github/workflows/macos-clang-mtl.yaml
 
 jobs:
   macOS-Metal-Clang:
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/build-and-test-callable.yaml
     with:
       OS: macOS

.github/workflows/macos-dxc-mtl.yaml

@@ -2,15 +2,20 @@ name: macOS Metal DXC
 
 permissions:
   contents: read
-  checks: write
 
 on:
   workflow_dispatch:
   schedule:
     - cron: '*/30 * * * *' # run every 30 minutes
+  pull_request:
+    paths:
+     - .github/workflows/macos-dxc-mtl.yaml
 
 jobs:
   macOS-Metal-DXC:
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/build-and-test-callable.yaml
     with:
       OS: macOS

.github/workflows/pr-description-checker.yml

@@ -11,7 +11,7 @@ jobs:
   check-pr-description:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: jadrol/pr-description-checker-action@c659fed338a52d657d34462c8bc7fc1f65d25758
         id: description-checker
         with:

.github/workflows/pr-matrix.yaml

@@ -2,7 +2,6 @@ name: Execution Testing
 
 permissions:
   contents: read
-  checks: write
 
 on:
   pull_request:
@@ -15,6 +14,9 @@ concurrency:
 
 jobs:
   Exec-Tests-Windows:
+    permissions:
+      contents: read
+      checks: write
     strategy:
       fail-fast: false
       matrix:
@@ -30,6 +32,9 @@ jobs:
       LLVM-ExtraCMakeArgs: -DCMAKE_C_COMPILER=clang-cl -DCMAKE_CXX_COMPILER=clang-cl -DOFFLOADTEST_USE_CLANG_TIDY=On
 
   Exec-Tests-Windows-Warp:
+    permissions:
+      contents: read
+      checks: write
     strategy:
       fail-fast: false
       matrix:
@@ -45,6 +50,9 @@ jobs:
       LLVM-ExtraCMakeArgs: -DCMAKE_C_COMPILER=clang-cl -DCMAKE_CXX_COMPILER=clang-cl -DOFFLOADTEST_USE_CLANG_TIDY=On
 
   Exec-Tests-Extra:
+    permissions:
+      contents: read
+      checks: write
     if: contains( github.event.pull_request.labels.*.name, 'test-all')
     strategy:
       fail-fast: false
@@ -61,6 +69,9 @@ jobs:
       LLVM-ExtraCMakeArgs: -DCMAKE_C_COMPILER=clang-cl -DCMAKE_CXX_COMPILER=clang-cl -DOFFLOADTEST_USE_CLANG_TIDY=On
 
   Exec-Tests-MacOS:
+    permissions:
+      contents: read
+      checks: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/windows-amd-clang-d3d12.yaml

@@ -2,15 +2,20 @@ name: Windows D3D12 AMD Clang
 
 permissions:
   contents: read
-  checks: write
 
 on:
   workflow_dispatch:
   schedule:
     - cron: '0 */6 * * *' # run every 6 hours
+  pull_request:
+    paths:
+     - .github/workflows/windows-amd-clang-d3d12.yaml
 
 jobs:
   Windows-D3D12-AMD-Clang:
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/build-and-test-callable.yaml
     with:
       OS: windows

.github/workflows/windows-amd-clang-vk.yaml

@@ -2,15 +2,20 @@ name: Windows Vulkan AMD Clang
 
 permissions:
   contents: read
-  checks: write
 
 on:
   workflow_dispatch:
   schedule:
     - cron: '0 */6 * * *' # run every 6 hours
+  pull_request:
+    paths:
+     - .github/workflows/windows-amd-clang-vk.yaml
 
 jobs:
   Windows-VK-AMD-Clang:
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/build-and-test-callable.yaml
     with:
       OS: windows

.github/workflows/windows-amd-clang-warp-d3d12.yaml

@@ -2,15 +2,20 @@ name: Windows D3D12 Warp Clang
 
 permissions:
   contents: read
-  checks: write
 
 on:
   workflow_dispatch:
   schedule:
     - cron: '0 */6 * * *' # run every 6 hours
+  pull_request:
+    paths:
+     - .github/workflows/windows-amd-clang-warp-d3d12.yaml
 
 jobs:
   Windows-D3D12-Warp-Clang:
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/build-and-test-callable.yaml
     with:
       OS: windows

.github/workflows/windows-amd-clang-warp-preview-d3d12.yaml

@@ -2,13 +2,18 @@ name: Windows D3D12 Warp Preview Clang
 
 permissions:
   contents: read
-  checks: write
 
 on:
   workflow_dispatch:
+  pull_request:
+    paths:
+     - .github/workflows/windows-amd-clang-warp-preview-d3d12.yaml
 
 jobs:
   Windows-D3D12-Warp-Clang:
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/build-and-test-callable.yaml
     with:
       OS: windows

.github/workflows/windows-amd-dxc-d3d12.yaml

@@ -2,15 +2,20 @@ name: Windows D3D12 AMD DXC
 
 permissions:
   contents: read
-  checks: write
 
 on:
   workflow_dispatch:
   schedule:
     - cron: '0 */6 * * *' # run every 6 hours
+  pull_request:
+    paths:
+     - .github/workflows/windows-amd-dxc-d3d12.yaml
 
 jobs:
   Windows-D3D12-AMD-DXC:
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/build-and-test-callable.yaml
     with:
       OS: windows