x86_64 AMX (int8 + bf16) & AVX-512-VNNI GEMM kernels — validated on AMX hardware

.all_crates.sh

@@ -1,2 +1,2 @@
 
-ALL_CRATES_PATH="data linalg core nnef nnef/nnef-resources pulse-opl pulse extra transformers hir tflite tensorflow onnx-opl onnx gpu metal cuda libcli api/rs api/ffi api/proxy/sys api/proxy cli"
+ALL_CRATES_PATH="data linalg core nnef nnef/nnef-resources pulse-opl pulse extra transformers hir tflite tensorflow onnx-opl onnx gpu metal cuda libcli api api/rs api/ffi api/proxy/sys api/proxy cli"

.github/dependabot.yml

@@ -9,6 +9,8 @@ updates:
       actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "cargo"
     directory: "/"
@@ -20,6 +22,8 @@ updates:
       rust-dependencies:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pip"
     directory: "/api/py"
@@ -29,3 +33,5 @@ updates:
     schedule:
       interval: "weekly"
       day: "monday"
+    cooldown:
+      default-days: 7

.github/workflows/asan.yml

@@ -9,6 +9,9 @@ env:
   CARGO_INCREMENTAL: false
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE20: true
 
+permissions:
+  contents: read
+
 jobs:
   sanitizer-address:
     strategy:
@@ -19,7 +22,9 @@ jobs:
     runs-on: ${{matrix.os}}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Rustup update
       run: rustup update
     - name: Run sanitized tests

.github/workflows/binaries.yml

@@ -14,9 +14,14 @@
   CARGO_INCREMENTAL: false
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE20: true
 
+permissions:
+  contents: read
+
 jobs:
   assets:
     name: Upload Release Binaries
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -48,30 +53,39 @@
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Extract version tag
         id: version
+        env:
+          VERSION_OVERRIDE: ${{ inputs.version_override }}
+          GH_REF: ${{ github.ref }}
         run: |
-          if [ -n "${{ inputs.version_override }}" ]; then
-            echo "value=${{ inputs.version_override }}" >> $GITHUB_OUTPUT
+          if [ -n "$VERSION_OVERRIDE" ]; then
+            echo "value=$VERSION_OVERRIDE" >> "$GITHUB_OUTPUT"
           else
-            echo "value=$(echo ${{ github.ref }} | cut -f 3 -d / | sed 's/^v//' )" >> $GITHUB_OUTPUT
+            echo "value=$(echo "$GH_REF" | cut -f 3 -d / | sed 's/^v//' )" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Build tract
+        env:
+          TARGET: ${{ matrix.target }}
+          MUSL: ${{ matrix.musl }}
+          VERSION: ${{ steps.version.outputs.value }}
         run: |
           set -ex
-          target=${{matrix.target}}
-          version=${{steps.version.outputs.value}}
+          target="$TARGET"
+          version="$VERSION"
           name=${target}-${version}
 
           rustup update
           rustup target add ${target}
 
-          if [ -n "${{matrix.musl}}" ]
+          if [ -n "$MUSL" ]
           then
-            MUSL_TRIPLE=${{matrix.musl}}
+            MUSL_TRIPLE="$MUSL"
             curl -s https://s3.amazonaws.com/tract-ci-builds/toolchains/${MUSL_TRIPLE}-cross.tgz | tar zx
 
             MUSL_BIN=`pwd`/${MUSL_TRIPLE}-cross/bin
@@ -90,7 +104,7 @@
           tar czf tract-${name}.tgz tract-${name}
 
       - name: Upload asset
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           files: tract-${{matrix.target}}-${{ steps.version.outputs.value }}.tgz
           name: ${{ steps.version.outputs.value }}

.github/workflows/cost_model.yml

@@ -12,6 +12,9 @@ env:
   CARGO_INCREMENTAL: false
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE20: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Upload cost model tasks
@@ -22,11 +25,14 @@ jobs:
         target: [ "aarch64", "armv7" ]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Build and upload
-        run: ./.travis/cost_model_task_build.sh ${{matrix.target}} ${{github.event.inputs.dataset_id}}
+        run: ./.travis/cost_model_task_build.sh ${{matrix.target}} ${GITHUB_EVENT_INPUTS_DATASET_ID}
         env:
           AWS_ACCESS_KEY_ID: ${{secrets.TRACT_CI_AWS_ACCESS_KEY_ID}}
           AWS_SECRET_ACCESS_KEY: ${{secrets.TRACT_CI_AWS_SECRET_ACCESS_KEY}}
           AWS_EC2_METADATA_DISABLED: true
+          GITHUB_EVENT_INPUTS_DATASET_ID: ${{github.event.inputs.dataset_id}}

.github/workflows/crates.yml

@@ -10,6 +10,9 @@ env:
   CARGO_INCREMENTAL: false
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE20: true
 
+permissions:
+  contents: read
+
 jobs:
   prepare-matrix:
     runs-on: ubuntu-latest
@@ -50,7 +53,9 @@ jobs:
       RUSTUP_TOOLCHAIN: ${{matrix.rust}}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
 
     - name: Cargo test
       run: cargo test -p ${{matrix.crate}}
@@ -65,7 +70,9 @@ jobs:
     env:
       RUSTUP_TOOLCHAIN: ${{matrix.rust}}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
 
     - name: Cargo test
       run: cargo test -p tract-cuda -p test-cuda
@@ -80,7 +87,9 @@ jobs:
     env:
       RUSTUP_TOOLCHAIN: "1.91.0"
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Minimum-BOM GPU smoke
       run: harness/cuda-minimum-deploy/gpu-ci.sh
 
@@ -94,7 +103,9 @@ jobs:
     env:
       RUSTUP_TOOLCHAIN: ${{matrix.rust}}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
 
     - name: Cargo test
       run: cargo test -p tract-metal -p test-metal
@@ -111,7 +122,9 @@ jobs:
     env:
       RUSTUP_TOOLCHAIN: ${{matrix.rust}}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - run: rustup component add clippy && cargo clippy
     - name: fmt
       run: rustup component add rustfmt && cargo fmt --check
@@ -127,7 +140,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Install cargo-deny
       run: |
         curl -L https://github.com/EmbarkStudios/cargo-deny/releases/download/$VERSION/cargo-deny-$VERSION-x86_64-unknown-linux-musl.tar.gz \

.github/workflows/cross-platform.yml

@@ -5,14 +5,57 @@
   schedule:
     - cron:  '0 5 * * *'
   workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "Optional PR number to test (from fork ok). Leave empty to run on selected branch."
+        required: false
+        type: number
 
 env:
   CARGO_INCREMENTAL: false
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE20: true
   RUSTUP_TOOLCHAIN: 1.91.0
 
+permissions:
+  contents: read
+
 jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      test_ref: ${{ steps.set.outputs.test_ref }}
+      tract_bench_branch_name: ${{ steps.set.outputs.tract_bench_branch_name }}
+    steps:
+      - id: set
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            core.info(`event: ${context.eventName}`);
+            core.info(`payload.inputs: ${JSON.stringify(context.payload.inputs)}`);
+            core.info(`payload.pull_request.number: ${context.payload.pull_request?.number}`);
+            const prInput = context.payload.inputs?.pr_number ?? context.payload.pull_request?.number;
+            core.info(`prInput: ${prInput} (type: ${typeof prInput})`);
+            let ref, branch;
+            if (prInput) {
+              const pr = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: Number(prInput),
+              });
+              ref = pr.data.head.sha;
+              branch = `pr-${prInput}-${pr.data.head.ref}`;
+            } else {
+              ref = process.env.GITHUB_SHA;
+              branch = process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME || 'main';
+            }
+            const benchBranch = branch.replace(/\//g, '_');
+            core.info(`test_ref: ${ref}`);
+            core.info(`tract_bench_branch_name: ${benchBranch}`);
+            core.setOutput('test_ref', ref);
+            core.setOutput('tract_bench_branch_name', benchBranch);
+
   linux:
+    needs: prepare
     strategy:
       fail-fast: false
       matrix:
@@ -40,20 +83,24 @@
       contents: read
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        ref: ${{ needs.prepare.outputs.test_ref }}
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Get current date
       id: date
       run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
 
     - name: Configure AWS Credentials
       continue-on-error: true
-      uses: aws-actions/configure-aws-credentials@v6
+      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6
       with:
         role-to-assume: arn:aws:iam::567805100031:role/github-runner-tract-ci
         aws-region: us-east-2
 
-    - uses: actions/cache@v5
+    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
       with:
         path: |
           ~/.rustup
@@ -65,16 +112,22 @@
         key: ${{ runner.os }}-${{matrix.platform}}-${{steps.date.outputs.date}}
 
     - name: Setup wasmtime
-      if: ${{ matrix.platform }} == "wasm32-wasi"
-      uses: bytecodealliance/actions/wasmtime/setup@v1
+      if: matrix.platform == 'wasm32-wasi'
+      uses: bytecodealliance/actions/wasmtime/setup@9152e710e9f7182e4c29ad218e4f335a7b203613 # v1
 
     - name: Cross script
       env:
         PLATFORM: ${{matrix.platform}}
         AWS_EC2_METADATA_DISABLED: true
-      run: .travis/cross.sh
+        NEEDS_PREPARE_OUTPUTS_TRACT_BENCH_BRANCH_NAME: ${{ needs.prepare.outputs.tract_bench_branch_name }}
+        NEEDS_PREPARE_OUTPUTS_TEST_REF: ${{ needs.prepare.outputs.test_ref }}
+      run: |
+        export TRACT_BENCH_BRANCH_NAME="${NEEDS_PREPARE_OUTPUTS_TRACT_BENCH_BRANCH_NAME}"
+        export GITHUB_SHA="${NEEDS_PREPARE_OUTPUTS_TEST_REF}"
+        .travis/cross.sh
 
   apple:
+    needs: prepare
     strategy:
       fail-fast: false
       matrix:
@@ -88,11 +141,15 @@
       contents: read
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        ref: ${{ needs.prepare.outputs.test_ref }}
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Configure AWS Credentials
       continue-on-error: true
-      uses: aws-actions/configure-aws-credentials@v6
+      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6
       with:
         role-to-assume: arn:aws:iam::567805100031:role/github-runner-tract-ci
         aws-region: us-east-2
@@ -104,4 +161,9 @@
     - name: Cross script
       env:
         PLATFORM: ${{matrix.platform}}
-      run: .travis/cross.sh
+        NEEDS_PREPARE_OUTPUTS_TRACT_BENCH_BRANCH_NAME: ${{ needs.prepare.outputs.tract_bench_branch_name }}
+        NEEDS_PREPARE_OUTPUTS_TEST_REF: ${{ needs.prepare.outputs.test_ref }}
+      run: |
+        export TRACT_BENCH_BRANCH_NAME="${NEEDS_PREPARE_OUTPUTS_TRACT_BENCH_BRANCH_NAME}"
+        export GITHUB_SHA="${NEEDS_PREPARE_OUTPUTS_TEST_REF}"
+        .travis/cross.sh