fix: resolve merge conflicts and use monkeypatch in cudnn_convolution tests

Author: factnn

.github/dependabot.yml

@@ -0,0 +1,21 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions-minor:
+        update-types:
+          - minor
+          - patch

.github/workflows/auto-sync.yaml

@@ -0,0 +1,35 @@
+name: Sync to remote site
+on:
+
+  workflow_dispatch:
+
+  # Note: use 'push' because we want to cover both manual push
+  # and PR merge events.
+  push:
+    branches:
+      - master
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    strategy:
+      matrix:
+        include:
+          - job_name: sync-to-gitcode
+            remote: gitcode.com
+            repository: FlagGems
+            branch: master
+          - job_name: sync-to-gitlink
+            remote: code.gitlink.org.cn
+            repository: FlagGems
+            branch: master
+    name: ${{ matrix.job_name }}
+    uses: flagos-ai/build-infra/.github/workflows/sync-to-remote.yaml@main
+    with:
+      remote: ${{ matrix.remote }}
+      repository: ${{ matrix.repository }}
+      branch: ${{ matrix.branch }}
+    secrets:
+      GITCODE_SSH_KEY: ${{ secrets.GITCODE_SSH_KEY }}

.github/workflows/backend-test.yaml

@@ -17,42 +17,55 @@ on:
         required: false
         type: string
         default: ''
-      test_script:
-        description: 'Path to test script under tools/'
-        required: true
-        type: string
       changed_files:
         description: 'List of changed files in a PR'
         required: false
         type: string
         default: ''
+      pr_id:
+        description: 'ID of the PR'
+        required: false
+        type: string
+        default: ''
+      test_script:
+        description: "Temporary parameter for alpha-ops test"
+        required: false
+        type: string
+        default: ''
+    secrets:
+      RUNNER_SSH_KEY:
+        required: true
 
-# NOTE: The following environment variables are for CI runners to
-# mitigate the network connection problems. However, this may not work
-# if the PR is triggered from a forked repository because in that case
-# GitHub doesn't allow the workflow to access any secrets.
-# env:
-#  http_proxy: ${{ secrets.HTTP_PROXY }}
-#  https_proxy: ${{ secrets.HTTPS_PROXY }}
+permissions:
+  contents: read
 
 jobs:
   test:
     runs-on: ${{ inputs.runner_label }}
     concurrency:
       group: >-
-        op-test-${{ inputs.vendor }}-
-        ${{ github.event.pull_request.number || github.ref }}
+        op-test-${{ inputs.vendor }}-${{ github.event.pull_request.number || github.ref }}
       cancel-in-progress: true
     steps:
       - uses: actions/checkout@v6
+        with:
+          ssh-key: ${{ secrets.RUNNER_SSH_KEY }}
       - name: Check GPU availability
         if: ${{ inputs.gpu_check_script != '' }}
         shell: bash
         run: |
           bash ${{ inputs.gpu_check_script }}
+      - name: Test alpha ops
+        if: ${{ inputs.test_script != '' }}
+        env:
+          CHANGED_FILES: ${{ inputs.changed_files }}
+        shell: bash
+        run: |
+          bash ${{ inputs.test_script }} ${{ inputs.vendor }} ${{ inputs.pr_id }}
       - name: Run backend tests
+        if: ${{ inputs.test_script == '' }}
         env:
           CHANGED_FILES: ${{ inputs.changed_files }}
         shell: bash
         run: |
-          bash ${{ inputs.test_script }} ${{ inputs.vendor }}
+          bash tools/test_backends.sh ${{ inputs.vendor }} ${{ inputs.pr_id }}

.github/workflows/code_scan.yaml

@@ -9,13 +9,15 @@ on:
 jobs:
   scan-code-and-report:
     runs-on: scan
+    permissions:
+      contents: read
     if: ${{ github.repository == 'flagos-ai/FlagGems' }}
     concurrency:
       group: scan-code-and-report-${{ github.event.pull_request.number || github.ref }}
       cancel-in-progress: true
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Scan gems repo
         shell: bash

.github/workflows/coverage.yaml

@@ -26,7 +26,7 @@ jobs:
           ref: gh-pages
 
       - id: download
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           result-encoding: string
           script: |
@@ -75,21 +75,29 @@ jobs:
         shell: bash
         run: |
           COV_ID=$(cat ${{ runner.temp }}/artifacts/COVERAGE_ID)
-          echo "COV_ID=${COV_ID}" > $GITHUB_ENV
+          # Strip any newline characters to prevent environment variable injection
+          COV_ID=${COV_ID//$'\r'/}
+          COV_ID=${COV_ID//$'\n'/}
+          # Ensure COV_ID only contains safe characters (alphanumerics, underscore, dash)
+          if ! [[ "$COV_ID" =~ ^[A-Za-z0-9_-]+$ ]]; then
+            echo "Invalid COVERAGE_ID value: '$COV_ID'" >&2
+            exit 1
+          fi
+          echo "COV_ID=${COV_ID}" > "$GITHUB_ENV"
           DATE=${COV_ID:0:8}
 
-          rm -fr hugo-docs/static/coverage/${COV_ID}*
-          mkdir -p hugo-docs/static/coverage/${COV_ID}
-          mv ${{ runner.temp }}/artifacts/htmlcov/* hugo-docs/static/coverage/${COV_ID}/
+          rm -fr docs/static/coverage/${COV_ID}*
+          mkdir -p docs/static/coverage/${COV_ID}
+          mv ${{ runner.temp }}/artifacts/htmlcov/* docs/static/coverage/${COV_ID}/
 
-          mv ${{ runner.temp }}/artifacts/ut-summary.md hugo-docs/content/en/references/test/unit/${DATE}-summary.md
+          mv ${{ runner.temp }}/artifacts/ut-summary.md docs/content/en/references/test/unit/${DATE}-summary.md
 
       - id: commit-change
         if: ${{ steps.download.outputs.result == 'HAS_DATA' }}
         run: |
           git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config --local user.name "github-actions[bot]"
-          git add hugo-docs
+          git add docs
           git commit -a -m "Add coverage data for ${COV_ID}"
 
       - id: push-change

.github/workflows/cpp-op-test.yaml

@@ -1,5 +1,8 @@
 name: cpp-ops
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
 
@@ -9,13 +12,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - shell: bash
-        env:
-          SKBUILD_CMAKE_ARGS: >
-            -DFLAGGEMS_BUILD_C_EXTENSIONS=ON
-            -DCMAKE_C_COMPILER=/usr/bin/gcc-11
-            -DCMAKE_CXX_COMPILER=/usr/bin/g++-11
         run: |
-          pip install --no-build-isolation -v -e .
+          CXX=/usr/bin/g++-11 CC=/usr/bin/gcc-11 SKBUILD_CMAKE_ARGS="-DFLAGGEMS_BUILD_C_EXTENSIONS=ON" pip install --no-build-isolation -v -e .
       - shell: bash
         run: |
           cd build/cpython-311/ctests

.github/workflows/daily.yaml

@@ -11,6 +11,8 @@
 # TODO(Qiming): Enable daily tests for benchmark and all backends
 
 name: daily
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:

.github/workflows/hugo-site.yaml

@@ -3,17 +3,31 @@ on:
   push:
     branches:
       - gh-pages
+
   workflow_dispatch:
+
+  workflow_call:
+
+  # When coverage data is collected and pushed to gh-pages branch
+  workflow_run:
+    workflows:
+      - coverage
+    types:
+      - completed
+
 permissions:
   contents: read
   pages: write
   id-token: write
+
 concurrency:
   group: pages
   cancel-in-progress: false
+
 defaults:
   run:
     shell: bash
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -23,53 +37,64 @@ jobs:
       HUGO_VERSION: 0.156.0
       NODE_VERSION: 24.13.1
       TZ: Europe/Oslo
+
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           ref: gh-pages
           submodules: recursive
           fetch-depth: 0
+
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: false
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
+
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6.0.0
+
       - name: Create directory for user-specific executable files
         run: |
           mkdir -p "${HOME}/.local"
+
       - name: Install Dart Sass
         run: |
           curl -sLJO "https://github.com/sass/dart-sass/releases/download/${DART_SASS_VERSION}/dart-sass-${DART_SASS_VERSION}-linux-x64.tar.gz"
           tar -C "${HOME}/.local" -xf "dart-sass-${DART_SASS_VERSION}-linux-x64.tar.gz"
           rm "dart-sass-${DART_SASS_VERSION}-linux-x64.tar.gz"
           echo "${HOME}/.local/dart-sass" >> "${GITHUB_PATH}"
+
       - name: Install Hugo
         run: |
           curl -sLJO "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz"
           mkdir "${HOME}/.local/hugo"
           tar -C "${HOME}/.local/hugo" -xf "hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz"
           rm "hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz"
           echo "${HOME}/.local/hugo" >> "${GITHUB_PATH}"
+
       - name: Verify installations
         run: |
           echo "Dart Sass: $(sass --version)"
           echo "Go: $(go version)"
           echo "Hugo: $(hugo version)"
           echo "Node.js: $(node --version)"
+
       - name: Install Node.js dependencies
         run: |
           [[ -f package-lock.json || -f npm-shrinkwrap.json ]] && npm ci || true
+
       - name: Configure Git
         run: |
           git config core.quotepath false
+
       - name: Cache restore
         id: cache-restore
         uses: actions/cache/restore@v5
@@ -78,31 +103,35 @@ jobs:
           key: hugo-${{ github.run_id }}
           restore-keys:
             hugo-
+
       - name: Build the site
         run: |
-          cd hugo-docs
+          cd docs
           hugo build \
             --gc \
             --minify \
             --baseURL "${{ steps.pages.outputs.base_url }}/" \
             --cacheDir "${{ runner.temp }}/hugo_cache"
+
       - name: Cache save
         id: cache-save
         uses: actions/cache/save@v5
         with:
           path: ${{ runner.temp }}/hugo_cache
           key: ${{ steps.cache-restore.outputs.cache-primary-key }}
+
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
-          path: ./hugo-docs/public
+          path: ./docs/public
+
   deploy:
+    runs-on: ubuntu-latest
+    needs: build
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    needs: build
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/image-builder.yaml

@@ -1,5 +1,8 @@
 name: image-builder
 
+permissions:
+  contents: read
+
 on:
   schedule:
     - cron: '0 3 * * *'