Merge branch 'main' into wangchang/inc3.x

.github/checkgroup.yml

@@ -30,13 +30,6 @@ subprojects:
       - "optimize-unit-test-PR-test"
       - "Genreate-OptimizeUT-Report"
 
-  - id: "Neural Speed Unit Test workflow"
-    paths:
-      - .github/workflows/unit-test-neuralspeed.yml
-      - ".github/workflows/script/unitTest/run_unit_test_neuraspeed.sh"
-    checks:
-      - "neural-speed-unit-test"
-
   - id: "NeuralChat Unit Test"
     paths:
       - ".github/workflows/unit-test-neuralchat.yml"

.github/workflows/Scaner_BDBA.yaml

@@ -3,7 +3,6 @@ name: Scanner BDBA
 on:
   workflow_dispatch:
 
-permissions: write-all
 jobs:
   bdba_job:
     name: BDBA Scan

.github/workflows/Scaner_Coverity.yaml

@@ -3,7 +3,6 @@ name: Scanner Coverity PYTHON
 on:
     workflow_dispatch:
 
-permissions: write-all
 jobs:
   coverity_job:
     name: Coverity

.github/workflows/Scaner_Trivy.yaml

@@ -2,7 +2,6 @@ name: Trivy Scan for Containers
 
 on:
     workflow_dispatch:
-permissions: write-all
 jobs:
   trivy_container_job:
     uses: "intel-innersource/frameworks.ai.infrastructure.code-scan-tools/.github/workflows/Scanner_Trivy.yml@one-ci-cd"

.github/workflows/build-container.yaml

@@ -3,7 +3,9 @@ on:
   workflow_dispatch: # Can be manually executed
   schedule: # 1/week Sunday at 07:00AM
     - cron: "5 7 * * 0"
-permissions: write-all
+permissions:
+  contents: read
+
 jobs:
   build:
     container: # MLOps Dev container for Compose Automation

.github/workflows/chatbot-finetune-mpt-7b-chat-hpu.yml

@@ -6,7 +6,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-ft-mpt-7b-hpu
   cancel-in-progress: true
-permissions: write-all
+permissions:
+  contents: read
+
 jobs:
   finetuning:
     name: finetuning test

.github/workflows/chatbot-finetune-mpt-7b-chat.yml

@@ -6,7 +6,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-ft-mpt-7b
   cancel-in-progress: true
-permissions: write-all
+permissions:
+  contents: read
+
 jobs:
   finetuning:
     name: finetuning test

.github/workflows/chatbot-inference-llama-2-7b-chat-hf.yml

@@ -6,7 +6,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-inf-lla-7b
   cancel-in-progress: true
-permissions: write-all
+permissions:
+  contents: read
+
 jobs:
   inference:
     name: inference test

.github/workflows/chatbot-inference-llama-2-7b_70b-chat-hf-hpu.yml

@@ -6,7 +6,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-inf-lla-7b-hpu
   cancel-in-progress: true
-permissions: write-all
+permissions:
+  contents: read
+
 jobs:
   inference:
     name: inference test

.github/workflows/chatbot-inference-mpt-7b-chat-hpu.yml

@@ -6,7 +6,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-inf-mpt-7b-hpu
   cancel-in-progress: true
-permissions: write-all
+permissions:
+  contents: read
+
 jobs:
   inference:
     name: inference test

.github/workflows/chatbot-inference-mpt-7b-chat.yml

@@ -6,7 +6,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-inf-mpt-7b
   cancel-in-progress: true
-permissions: write-all
+permissions:
+  contents: read
+
 jobs:
   inference:
     name: inference test

.github/workflows/chatbot-test.yml

@@ -27,7 +27,6 @@ on:
       - '!intel_extension_for_transformers/neural_chat/README.md'
 
   workflow_dispatch:
-permissions: write-all
 # If there is a new commit, the previous jobs will be canceled
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

.github/workflows/chatbot_finetuning.yml

@@ -7,7 +7,6 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
-permissions: write-all
 jobs:
   call-finetune-mpt-7b-chat:
     uses: ./.github/workflows/chatbot-finetune-mpt-7b-chat.yml

.github/workflows/deploy-test.yml

@@ -7,7 +7,6 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
-permissions: write-all
 env:
   OUT_SCRIPT_PATH: ${{ github.workspace }}/.github/workflows/script/models
   SCRIPT_PATH: /intel-extension-for-transformers/.github/workflows/script
@@ -19,8 +18,15 @@ env:
   EXTRA_CONTAINER_NAME: "utTest"
   EXTRA_CONTAINER_NAME2: "codeScan"
 
+permissions:
+  contents: read
+
 jobs:
   Deploy-Workflow:
+    permissions:
+      actions: read  # for dawidd6/action-download-artifact to query and download artifacts
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for dawidd6/action-download-artifact to query commit hash
     runs-on: itrex-node
     strategy:
       matrix:
@@ -128,6 +134,10 @@ jobs:
           retention-days: 60 # 1 <= retention-days <= 90
 
   Genreate-Report:
+    permissions:
+      actions: read  # for dawidd6/action-download-artifact to query and download artifacts
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for dawidd6/action-download-artifact to query commit hash
     runs-on: itrex-node-spell
     needs: [Deploy-Workflow]
     steps:

.github/workflows/format_scan.yml

@@ -11,7 +11,6 @@ on:
       - .github/workflows/format_scan.yml
       - .github/workflows/script/formatScan/**
   workflow_dispatch:
-permissions: write-all
 # If there is a new commit, the previous jobs will be canceled
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -24,6 +23,9 @@ env:
   DOCKER_FILE_NAME: "codeScan"
   CONTAINER_NAME: "codeScan"
 
+permissions:
+  contents: read
+
 jobs:
   format-scan:
     runs-on: itrex-node-spell

.github/workflows/llm-test.yml

@@ -13,7 +13,6 @@ on:
        - "!intel_extension_for_transformers/transformers/runtime/third_party/**"
        - "!intel_extension_for_transformers/transformers/runtime/docs/**"
   workflow_dispatch:
-permissions: write-all
 # If there is a new commit, the previous jobs will be canceled
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -26,6 +25,9 @@ env:
   EXTRA_CONTAINER_NAME: "codeScan"
 
 
+permissions:
+  contents: read
+
 jobs:
   LLM-Workflow:
     runs-on: spr
@@ -50,6 +52,7 @@ jobs:
       - name: Binary build
         run: |
           cd ${{ github.workspace }}
+          source ~/.bashrc
           conda activate llm-test || source activate llm-test
           compiler_version=11.1.0
           conda install --update-deps -c conda-forge gxx==${compiler_version} gcc==${compiler_version} gxx_linux-64==${compiler_version} libstdcxx-ng sysroot_linux-64 libxcrypt -y
@@ -83,6 +86,10 @@ jobs:
           retention-days: 60 # 1 <= retention-days <= 90
 
   Generate-LLM-Report:
+    permissions:
+      actions: read  # for dawidd6/action-download-artifact to query and download artifacts
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for dawidd6/action-download-artifact to query commit hash
     runs-on: itrex-node-spell
     needs: [LLM-Workflow]
     steps:

.github/workflows/optimize-test.yml

@@ -7,7 +7,6 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
-permissions: write-all
 env:
   OUT_SCRIPT_PATH: ${{ github.workspace }}/.github/workflows/script/models
   SCRIPT_PATH: /intel-extension-for-transformers/.github/workflows/script
@@ -20,8 +19,15 @@ env:
   EXTRA_CONTAINER_NAME2: "codeScan"
 
 
+permissions:
+  contents: read
+
 jobs:
   Optimize-Workflow:
+    permissions:
+      actions: read  # for dawidd6/action-download-artifact to query and download artifacts
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for dawidd6/action-download-artifact to query commit hash
     runs-on: itrex-node
     strategy:
       matrix:
@@ -133,6 +139,10 @@ jobs:
           retention-days: 60 # 1 <= retention-days <= 90
 
   Genreate-Report:
+    permissions:
+      actions: read  # for dawidd6/action-download-artifact to query and download artifacts
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for dawidd6/action-download-artifact to query commit hash
     runs-on: itrex-node-spell
     needs: [Optimize-Workflow]
     steps:

.github/workflows/publish.yml

@@ -5,10 +5,14 @@ on:
     branches:
       - main
   workflow_dispatch:
-permissions: write-all
+permissions:
+  contents: read
+
 jobs:
   build:
 
+    permissions:
+      contents: write  # for peaceiris/actions-gh-pages to push pages branch
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/script/launch_llm.sh

@@ -23,7 +23,7 @@ function main() {
     fi
 
     # init conda
-    #. $(dirname ${CONDA_EXE})/../etc/profile.d/conda.sh
+    source ~/.bashrc
     conda activate $conda_env || source activate $conda_env
 
     # env

.github/workflows/script/models/run_llm.sh

@@ -36,17 +36,16 @@ main() {
 }
 
 function prepare() {
-    [[ -d ${HOME}/anaconda3/bin ]] && export PATH=${HOME}/anaconda3/bin/:$PATH
-    [[ -d ${HOME}/miniconda3/bin ]] && export PATH=${HOME}/miniconda3/bin/:$PATH
-    export LD_LIBRARY_PATH=/lib64/libcrypto.so.1.1:${HOME}/miniconda3/envs/${conda_env_name}/lib/:$LD_LIBRARY_PATH
+    source ~/.bashrc
+    source activate ${conda_env_name} || conda activate ${conda_env_name}
+    export LD_LIBRARY_PATH=/lib64/libcrypto.so.1.1:${CONDA_PREFIX}/lib/:$LD_LIBRARY_PATH
     if [[ ${precision} == "fp8" ]]; then
         export NE_WEIGHT_FP8_4E3M=1
     fi
     if [[ ${model} == "gpt-j-6b" ]]|| [[ model == "gpt-j-6b-pruned" ]]; then
         working_dir="${WORKING_DIR}/examples/huggingface/pytorch/text-generation/deployment"
     fi
     $BOLD_YELLOW && echo "Running ---- ${framework}, ${model}----Prepare"
-    source activate ${conda_env_name} || conda activate ${conda_env_name}
     if [[ ${cpu} == *"spr"* ]] || [[ ${cpu} == *"SPR"* ]] || [[ ${cpu} == *"Spr"* ]]; then
         export CC=/opt/rh/gcc-toolset-11/root/usr/bin/gcc
         export CXX=/opt/rh/gcc-toolset-11/root/usr/bin/g++
@@ -56,8 +55,7 @@ function prepare() {
     echo "Working in ${working_dir}"
     echo -e "\nInstalling model requirements..."
     export PATH=/lib64/libcrypto.so.1.1:$PATH
-    cp /lib64/libcrypto.so.1.1 ${HOME}/miniconda3/envs/${conda_env_name}/lib/libcrypto.so.1.1
-    cp /lib64/libcrypto.so.1.1 ${HOME}/miniconda3/lib/libcrypto.so.1.1
+    cp /lib64/libcrypto.so.1.1 ${CONDA_PREFIX}/lib/libcrypto.so.1.1
     if [ -f "requirements.txt" ]; then
         sed -i '/^transformers/d' requirements.txt
         n=0

.github/workflows/script/prepare_env_with_conda.sh

@@ -6,13 +6,6 @@ if [[ -z "${conda_env_name}" ]] || [[ -z "${python_version}" ]]; then
     exit 1
 fi
 
+source ~/.bashrc
 conda create -n ${conda_env_name} python=${python_version} -y
 source activate ${conda_env_name} || conda activate ${conda_env_name}
-#pip install -U pip
-#
-#if [ -f "requirements.txt" ]; then
-#    python -m pip install --default-timeout=100 -r requirements.txt
-#    pip list
-#else
-#    echo "Not found requirements.txt file."
-#fi

.github/workflows/sparse_lib_CI.yml

@@ -8,7 +8,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-permissions: write-all
 
 env:
   DOCKER_CONFIG_NAME: "commonDockerConfig"
@@ -17,6 +16,9 @@ env:
   DOCKER_FILE_NAME: "unitTest"
   CONTAINER_NAME: "utTest"
 
+permissions:
+  contents: read
+
 jobs:
   sparselib:
     runs-on: itrex-node

.github/workflows/trellix.yaml

@@ -3,7 +3,9 @@ name: Trellix Command Line Scanner
 on:
   workflow_dispatch:
 
-permissions: write-all
+permissions:
+  contents: read
+
 jobs:
   Trellix:
     runs-on: inner-source

.github/workflows/unit-test-engine.yml

@@ -14,7 +14,6 @@ on:
       - "!intel_extension_for_transformers/transformers/runtime/third_party/**"
       - "!intel_extension_for_transformers/transformers/runtime/docs/**"
   workflow_dispatch:
-permissions: write-all
 # If there is a new commit, the previous jobs will be canceled
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -29,6 +28,9 @@ env:
   EXTRA_CONTAINER_NAME: "modelTest"
   CONTAINER_SCAN: "codeScan"
 
+permissions:
+  contents: read
+
 jobs:
   engine-unit-test:
     runs-on: [self-hosted, linux, X64, itrex-node]

.github/workflows/unit-test-kernel.yml

@@ -14,7 +14,6 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
-permissions: write-all
 env:
   DOCKER_CONFIG_NAME: "commonDockerConfig"
   REPO_NAME: "intel-extension-for-transformers"
@@ -23,6 +22,9 @@ env:
   CONTAINER_NAME: "utTest"
   EXTRA_CONTAINER_NAME: "modelTest"
 
+permissions:
+  contents: read
+
 jobs:
   unit-test:
     runs-on: [self-hosted, linux, X64, itrex-node]