Skip to content

Commit cc76d0a

Browse files
mihaimaruseacmihaimaruseac
authored
[NFC] Spurious linting fixes and checks (#104)
* Add lint to detect trailing whitespace. Also detect trailing empty lines at end of file. Signed-off-by: Mihai Maruseac <[email protected]> * Remove trailing whitespace, white lines. Signed-off-by: Mihai Maruseac <[email protected]> * Don't run CI twice. Having triggers for both push and PR without additional constraints causes some CI to run twice. Fix it so it only runs when PRs get created or updated. Signed-off-by: Mihai Maruseac <[email protected]> * Ensure only Windows files are CRLF ended. Add `.gitattributes` to force all files be LF. Will do another commit to fix those files that are already using the wrong line endings. Signed-off-by: Mihai Maruseac <[email protected]> * Convert files to LF line endings. Signed-off-by: Mihai Maruseac <[email protected]> --------- Signed-off-by: Mihai Maruseac <[email protected]>
1 parent aa94e08 commit cc76d0a

File tree

12 files changed

+197
-161
lines changed

12 files changed

+197
-161
lines changed

‎.gitattributes

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* text=auto

‎.github/workflows/codeql.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,4 +65,3 @@ jobs:
6565
uses: github/codeql-action/analyze@f9a7c6738f28efb36e31d49c53a201a9c5d6a476 # v2.14.2
6666
with:
6767
category: "/language:${{matrix.language}}"
68-

‎.github/workflows/dependency_review.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,10 @@
1313
# limitations under the License.
1414

1515
name: 'Dependency Review'
16-
on: [pull_request]
16+
on:
17+
pull_request:
18+
branches: [main]
19+
types: [opened, synchronize]
1720

1821
permissions:
1922
contents: read

‎.github/workflows/lint.yml

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
name: Lint
22

3-
on: [push, pull_request]
3+
on:
4+
pull_request:
5+
branches: [main]
6+
types: [opened, synchronize]
47

58
permissions: read-all
69

@@ -17,3 +20,27 @@ jobs:
1720
python-version: "3.11"
1821
- name: flake8 Lint
1922
uses: py-actions/flake8@84ec6726560b6d5bd68f2a5bed83d62b52bb50ba # v2.3.0
23+
- name: Detect empty lines at end of file and trailing whitespace
24+
run: |
25+
set -euxo pipefail # No -x here!
26+
failed=0
27+
# First, check for empty files at end
28+
for file in $(git ls-files --eol | grep 'i/[cr]*lf' | awk '{print $4}'); do
29+
lines=$(tac "$file" | awk 'NF{exit};END{print NR?NR-1:0}')
30+
if [[ $lines -ne 0 ]]; then
31+
line=$(wc -l "$file" | cut -d' ' -f1)
32+
echo "::error file=$file,line=$line::File $file has $lines empty lines at end. Please remove."
33+
failed=$((failed + 1))
34+
fi
35+
done
36+
# Next, check for files with whitespace at end of line. Remove CRLF files.
37+
for file in $(git ls-files --eol | grep 'i/lf' | awk '{print $4}'); do
38+
for line in $(grep -n '[[:space:]]$' "$file" | cut -d: -f1); do
39+
echo "::error file=$file,line=$line::File $file has trailing whitespace at line $line. Please remove."
40+
failed=$((failed + 1))
41+
done
42+
done
43+
if [[ $failed -ne 0 ]]; then
44+
echo "::error Found $failed whitespace errors, failing"
45+
exit 1
46+
fi

‎.github/workflows/pin_deps.yml

Lines changed: 98 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -1,98 +1,98 @@
1-
name: Pin dependencies
2-
on:
3-
workflow_dispatch:
4-
schedule:
5-
- cron: '0 0 * * TUE' # run every Tuesday at midnight
6-
7-
permissions: {}
8-
9-
defaults:
10-
run:
11-
shell: bash
12-
13-
jobs:
14-
pin:
15-
name: Generate dependency lock
16-
runs-on: ${{ matrix.os }}
17-
strategy:
18-
fail-fast: false # Don't cancel other jobs if one fails
19-
matrix:
20-
os: [ubuntu-latest, macos-latest, windows-latest]
21-
steps:
22-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
23-
- uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
24-
with:
25-
python-version: 3.11
26-
cache: pip
27-
cache-dependency-path: |
28-
model_signing/install/requirements_${{ runner.os }}.txt
29-
model_signing/install/requirements_test_${{ runner.os }}.txt
30-
slsa_for_models/install/requirements_${{ runner.os }}.txt
31-
- name: Create an empty virtualenv and install `pip-tools`
32-
run: |
33-
set -exuo pipefail
34-
python -m venv venv
35-
.github/workflows/scripts/venv_activate.sh
36-
pip install pip-tools
37-
pip list # For debugging
38-
- name: Use `pip-compile` to generate all freeze files
39-
run: |
40-
set -exuo pipefail
41-
.github/workflows/scripts/venv_activate.sh
42-
pip-compile --upgrade --generate-hashes --strip-extras --output-file=model_signing/install/requirements_${{ runner.os }}.txt model_signing/install/requirements.in
43-
pip-compile --upgrade --generate-hashes --strip-extras --output-file=model_signing/install/requirements_test_${{ runner.os }}.txt model_signing/install/requirements_test.in
44-
pip-compile --upgrade --generate-hashes --strip-extras --output-file=slsa_for_models/install/requirements_${{ runner.os }}.txt slsa_for_models/install/requirements.in
45-
- name: Test freeze file (for model signing)
46-
run: |
47-
set -exuo pipefail
48-
rm -rf venv # Need clean sandbox
49-
python -m venv venv
50-
.github/workflows/scripts/venv_activate.sh
51-
pip install -r model_signing/install/requirements_${{ runner.os }}.txt
52-
pip list # For debugging
53-
- name: Test freeze file (for testing model signing)
54-
run: |
55-
set -exuo pipefail
56-
rm -rf venv # Need clean sandbox
57-
python -m venv venv
58-
.github/workflows/scripts/venv_activate.sh
59-
pip install -r model_signing/install/requirements_test_${{ runner.os }}.txt
60-
pip list # For debugging
61-
- name: Test freeze file (for SLSA for models)
62-
run: |
63-
set -exuo pipefail
64-
rm -rf venv # Need clean sandbox
65-
python -m venv venv
66-
.github/workflows/scripts/venv_activate.sh
67-
pip install -r slsa_for_models/install/requirements_${{ runner.os }}.txt
68-
pip list # For debugging
69-
- name: Upload freeze files
70-
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
71-
with:
72-
name: freeze-files-${{ matrix.os }}
73-
path: ./*/install/requirements*${{ runner.os }}*txt
74-
75-
# Separate PR creation job to make sure it creates only one single PR with
76-
# all changed files, eliminate race-conditions and restrict permissions only
77-
# to this specific job.
78-
create-pr:
79-
needs: [pin]
80-
runs-on: ubuntu-latest
81-
permissions:
82-
contents: write
83-
pull-requests: write
84-
steps:
85-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
86-
- uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
87-
with:
88-
path: .
89-
merge-multiple: true
90-
- name: Create dependent PR with dependency changes
91-
uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
92-
with:
93-
title: "Update frozen python dependencies"
94-
commit-message: "Bump frozen dependencies"
95-
committer: "Mihai Maruseac (automated) <[email protected]>"
96-
author: "Mihai Maruseac (automated) <[email protected]>"
97-
signoff: true
98-
delete-branch: true
1+
name: Pin dependencies
2+
on:
3+
workflow_dispatch:
4+
schedule:
5+
- cron: '0 0 * * TUE' # run every Tuesday at midnight
6+
7+
permissions: {}
8+
9+
defaults:
10+
run:
11+
shell: bash
12+
13+
jobs:
14+
pin:
15+
name: Generate dependency lock
16+
runs-on: ${{ matrix.os }}
17+
strategy:
18+
fail-fast: false # Don't cancel other jobs if one fails
19+
matrix:
20+
os: [ubuntu-latest, macos-latest, windows-latest]
21+
steps:
22+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
23+
- uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
24+
with:
25+
python-version: 3.11
26+
cache: pip
27+
cache-dependency-path: |
28+
model_signing/install/requirements_${{ runner.os }}.txt
29+
model_signing/install/requirements_test_${{ runner.os }}.txt
30+
slsa_for_models/install/requirements_${{ runner.os }}.txt
31+
- name: Create an empty virtualenv and install `pip-tools`
32+
run: |
33+
set -exuo pipefail
34+
python -m venv venv
35+
.github/workflows/scripts/venv_activate.sh
36+
pip install pip-tools
37+
pip list # For debugging
38+
- name: Use `pip-compile` to generate all freeze files
39+
run: |
40+
set -exuo pipefail
41+
.github/workflows/scripts/venv_activate.sh
42+
pip-compile --upgrade --generate-hashes --strip-extras --output-file=model_signing/install/requirements_${{ runner.os }}.txt model_signing/install/requirements.in
43+
pip-compile --upgrade --generate-hashes --strip-extras --output-file=model_signing/install/requirements_test_${{ runner.os }}.txt model_signing/install/requirements_test.in
44+
pip-compile --upgrade --generate-hashes --strip-extras --output-file=slsa_for_models/install/requirements_${{ runner.os }}.txt slsa_for_models/install/requirements.in
45+
- name: Test freeze file (for model signing)
46+
run: |
47+
set -exuo pipefail
48+
rm -rf venv # Need clean sandbox
49+
python -m venv venv
50+
.github/workflows/scripts/venv_activate.sh
51+
pip install -r model_signing/install/requirements_${{ runner.os }}.txt
52+
pip list # For debugging
53+
- name: Test freeze file (for testing model signing)
54+
run: |
55+
set -exuo pipefail
56+
rm -rf venv # Need clean sandbox
57+
python -m venv venv
58+
.github/workflows/scripts/venv_activate.sh
59+
pip install -r model_signing/install/requirements_test_${{ runner.os }}.txt
60+
pip list # For debugging
61+
- name: Test freeze file (for SLSA for models)
62+
run: |
63+
set -exuo pipefail
64+
rm -rf venv # Need clean sandbox
65+
python -m venv venv
66+
.github/workflows/scripts/venv_activate.sh
67+
pip install -r slsa_for_models/install/requirements_${{ runner.os }}.txt
68+
pip list # For debugging
69+
- name: Upload freeze files
70+
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
71+
with:
72+
name: freeze-files-${{ matrix.os }}
73+
path: ./*/install/requirements*${{ runner.os }}*txt
74+
75+
# Separate PR creation job to make sure it creates only one single PR with
76+
# all changed files, eliminate race-conditions and restrict permissions only
77+
# to this specific job.
78+
create-pr:
79+
needs: [pin]
80+
runs-on: ubuntu-latest
81+
permissions:
82+
contents: write
83+
pull-requests: write
84+
steps:
85+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
86+
- uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
87+
with:
88+
path: .
89+
merge-multiple: true
90+
- name: Create dependent PR with dependency changes
91+
uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
92+
with:
93+
title: "Update frozen python dependencies"
94+
commit-message: "Bump frozen dependencies"
95+
committer: "Mihai Maruseac (automated) <[email protected]>"
96+
author: "Mihai Maruseac (automated) <[email protected]>"
97+
signoff: true
98+
delete-branch: true

‎.github/workflows/scorecard.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,4 +70,3 @@ jobs:
7070
uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
7171
with:
7272
sarif_file: results.sarif
73-

‎CONTRIBUTING.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,3 @@ use GitHub pull requests for this purpose.
3030
Contributions made by corporations are covered by a different agreement than the
3131
one above, the [Software Grant and Corporate Contributor License
3232
Agreement](https://cla.developers.google.com/about/google-corporate).
33-

‎README.md

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,10 @@
1818
## Overview
1919

2020
There is currently significant growth in the number of ML-powered applications.
21-
This brings benefits, but it also provides grounds for attackers to exploit
22-
unsuspecting ML users. This
23-
is why Google launched the [Secure AI Framework (SAIF)][saif] to establish industry
24-
standards for creating trustworthy and responsible AI applications. The first
25-
principle of SAIF is to
21+
This brings benefits, but it also provides grounds for attackers to exploit
22+
unsuspecting ML users. This is why Google launched the [Secure AI Framework
23+
(SAIF)][saif] to establish industry standards for creating trustworthy and
24+
responsible AI applications. The first principle of SAIF is to
2625

2726
> Expand strong security foundations to the AI ecosystem
2827

‎model_signing/benchmarks/run.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ model_init() {
157157
run "${model_name}" "${model_path}" model_init
158158

159159

160-
echo
160+
echo
161161
echo "===== RESULTS ======"
162162
# NOTE: Requires bash >= 4.4.
163163
echo "results:" "${!results[@]}"

0 commit comments

Comments
 (0)