|
| 1 | +# WebGPU Component Governance manifest |
| 2 | + |
| 3 | +This directory contains the WebGPU-specific Component Governance manifest for ONNX Runtime. It covers Dawn and the |
| 4 | +Dawn-derived dependency graph used when building the WebGPU Execution Provider. |
| 5 | + |
| 6 | +The manifest is named `cgmanifest.webgpu.json`, not `cgmanifest.json`, so default whole-repository Component |
| 7 | +Governance scans do not pick it up automatically. WebGPU packaging and NOTICE-generation pipelines should stage or copy |
| 8 | +this file as `cgmanifest.json` in the source directory that they scan for WebGPU package notices. |
| 9 | + |
| 10 | +## Classification policy |
| 11 | + |
| 12 | +The Component Governance manifest schema provides a `developmentDependency` boolean, but it does not provide separate |
| 13 | +first-class fields for runtime, build-tool, test-only, or conditional dependencies. This manifest uses: |
| 14 | + |
| 15 | +- no `developmentDependency` field for components that are redistributed, statically linked, or otherwise part of the |
| 16 | + WebGPU package/runtime dependency closure; |
| 17 | +- `developmentDependency: true` for Dawn dependencies that are only build tools, tests, disabled optional backends, or |
| 18 | + source inputs that current WebGPU packages do not redistribute; |
| 19 | +- `comments` to preserve the more precise classification and Dawn `DEPS` path/condition. |
| 20 | + |
| 21 | +If a WebGPU package starts redistributing a component currently marked as a development dependency, update that |
| 22 | +registration and explain the packaging path in `comments` and `detectedComponentLocations`. |
| 23 | + |
| 24 | +## Maintenance |
| 25 | + |
| 26 | +When rolling Dawn or changing WebGPU packaging: |
| 27 | + |
| 28 | +1. Update the Dawn registration to match the `dawn` entry in `cmake/deps.txt`. |
| 29 | +2. Re-audit the Dawn dependency graph for the pinned Dawn commit: |
| 30 | + - Start from the Dawn commit in `cmake/deps.txt`; do not audit Dawn `main` or a different roll. |
| 31 | + - Inspect Dawn's `tools/fetch_dawn_dependencies.py` at that commit. For ORT's normal source-fetch path, |
| 32 | + `cmake/external/onnxruntime_external_deps.cmake` enables `DAWN_FETCH_DEPENDENCIES`, so the script's |
| 33 | + `required_submodules` list is the primary set of Dawn source dependencies fetched for the build. |
| 34 | + - Cross-reference each fetched submodule path with Dawn's `DEPS` file to get the public upstream repository URL, |
| 35 | + commit, and condition. Use public upstream identities in this manifest, not internal mirrors. |
| 36 | + - Compare that fetched set against this manifest. Add new fetched components, update changed commits or repository |
| 37 | + URLs, and remove entries that are no longer fetched or relevant unless CG/legal guidance requires keeping them. |
| 38 | + - Cross-check ORT's Dawn CMake options in `cmake/external/onnxruntime_external_deps.cmake` and Dawn's |
| 39 | + `third_party/CMakeLists.txt` before classifying a component. Components that are redistributed, statically linked, |
| 40 | + or otherwise part of the WebGPU package/runtime closure should not be marked as development dependencies; build |
| 41 | + tools, test inputs, disabled optional backends, and unfetched conditional dependencies should be marked |
| 42 | + `developmentDependency: true` if they remain registered. |
| 43 | + - Verify actual WebGPU package contents, especially platform-specific artifacts. For example, the Windows WebGPU |
| 44 | + plugin pipeline downloads and redistributes DXC DLLs separately from Dawn's `third_party/dxc` source dependency, so |
| 45 | + both the Dawn build-input registration and the redistributed DXC release registration may need review. |
| 46 | + - Keep Dawn-derived registrations connected to the Dawn root with `dependencyRoots`. |
| 47 | +3. If the Windows WebGPU plugin pipeline changes the downloaded DXC release, update the DirectXShaderCompiler release |
| 48 | + registration to match `tools/ci_build/github/azure-pipelines/stages/plugin-win-webgpu-stage.yml`. |
| 49 | +4. Run: |
| 50 | + |
| 51 | + ```powershell |
| 52 | + python cgmanifests/webgpu/validate_webgpu_cgmanifest.py |
| 53 | + ``` |
| 54 | + |
| 55 | +The validator checks for stale Dawn and DXC pins, but it does not replace the manual dependency classification review |
| 56 | +in step 2. |
| 57 | + |
| 58 | +Non-git Dawn toolchain packages from CIPD/GCS, such as GN, Ninja, CMake, Go, Siso, reclient, and sysroots, are |
| 59 | +intentionally not registered here unless they become redistributed or CG/legal guidance requires build input coverage. |
| 60 | +They do not have stable public upstream source identities in the Dawn `DEPS` file and are not part of current WebGPU |
| 61 | +package contents. |
0 commit comments