Revert "Change to pull_request_target (#3025)"

This reverts commit 7d6afe1.

.github/workflows/code-quality.yaml

@@ -1,49 +1,30 @@
 name: Code Quality Checks
 on:
-  push:
-    branches:
-    - dev
-    - main
-    - release/**
-  pull_request_target:
-  workflow_dispatch:
-# Cancel old runs when a new commit is pushed to the same branch if not on main
-# or dev
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+  workflow_call:
+    inputs:
+      python_version:
+        required: true
+        type: string
+      pip_deps:
+        required: true
+        type: string
 defaults:
   run:
     working-directory: .
 jobs:
   code-quality:
     runs-on: ubuntu-20.04
     timeout-minutes: 15
-    strategy:
-      matrix:
-        python_version:
-        - "3.9"
-        - "3.10"
-        - "3.11"
-        pip_deps:
-        - "[dev]"
     steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-    - name: Get Repo Token
-      id: REPO_TOKEN
-      uses: tibdex/github-app-token@v1
+    - uses: actions/checkout@v3
+    - uses: actions/setup-python@v4
       with:
-        app_id: ${{ secrets.DEVOGE_BOT_PUB_APPID }}
-        private_key: ${{ secrets.DEVOGE_BOT_PUB_PEM }}
-    - name: Get composite run steps repository
-      uses: actions/checkout@v3
-      with:
-        repository: mosaicml/testing
-        ref: v0.0.2
-        path: ./testing
-        token: ${{ steps.REPO_TOKEN.outputs.token }}
-    - uses: ./testing/.github/actions/code-quality
-      with:
-        python_version: ${{ matrix.python_version }}
-        pip_deps: ${{ matrix.pip_deps }}
+        python-version: ${{ inputs.python_version }}
+    - name: Setup
+      run: |
+        set -ex
+        python -m pip install --upgrade 'pip<23' wheel
+        python -m pip install --upgrade .${{ inputs.pip_deps }}
+    - name: Run checks
+      run: |
+        pre-commit run --all-files

.github/workflows/codeql-analysis.yml

@@ -14,7 +14,7 @@ name: "CodeQL"
 on:
   push:
     branches: [dev, main]
-  pull_request_target:
+  pull_request:
     # The branches below must be a subset of the branches above
     branches: [dev, main]
   schedule:
@@ -41,19 +41,36 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2
-    - name: Get Repo Token
-      id: REPO_TOKEN
-      uses: tibdex/github-app-token@v1
-      with:
-        app_id: ${{ secrets.DEVOGE_BOT_PUB_APPID }}
-        private_key: ${{ secrets.DEVOGE_BOT_PUB_PEM }}
-    - name: Get composite run steps repository
-      uses: actions/checkout@v3
-      with:
-        repository: mosaicml/testing
-        ref: v0.0.2
-        path: ./testing
-        token: ${{ steps.REPO_TOKEN.outputs.token }}
-    - uses: ./testing/.github/actions/codeql-analysis
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
       with:
-        language: ${{ matrix.language }}
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a
+        # config file.
+        # By default, queries listed here will override any specified in a
+        # config file.
+        # Prefix the list here with "+" to use these queries and those in the
+        # config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually
+    # (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following
+    #    three lines and modify them (or add more) to build your code if your
+    #    project uses a compiled language
+
+    # - run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2

.github/workflows/coverage.yaml

@@ -5,31 +5,28 @@ on:
       download-path:
         required: true
         type: string
-    secrets:
-      app_id:
-        required: true
-      private_key:
-        required: true
 jobs:
   coverage:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v3
-    - name: Get Repo Token
-      id: REPO_TOKEN
-      uses: tibdex/github-app-token@v1
-      with:
-        app_id: ${{ secrets.app_id }}
-        private_key: ${{ secrets.private_key }}
-    - name: Get composite run steps repository
-      uses: actions/checkout@v3
-      with:
-        repository: mosaicml/testing
-        ref: v0.0.2
-        path: ./testing
-        token: ${{ steps.REPO_TOKEN.outputs.token }}
-    - uses: ./testing/.github/actions/coverage
+    - name: Setup
+      run: |
+        set -ex
+        python -m pip install --upgrade 'pip<23' wheel
+        pip install coverage[toml]==6.5.0
+    - name: Download artifacts
+      uses: actions/download-artifact@v3
       with:
-        download-path: ${{ inputs.download-path }}
+        path: ${{ inputs.download-path }}
+    - name: Generate coverage report
+      run: |
+        set -ex
+
+        # Flatten the coverage files
+        ls ${{ inputs.download-path }} | while read x; do mv ${{ inputs.download-path }}/$x/.coverage .coverage.$x; done
+
+        python -m coverage combine
+        python -m coverage report

.github/workflows/daily.yaml

@@ -97,9 +97,6 @@ jobs:
     needs: [daily-pytest-cpu]
     with:
       download-path: artifacts
-    secrets:
-      app_id: ${{ secrets.DEVOGE_BOT_PUB_APPID }}
-      private_key: ${{ secrets.DEVOGE_BOT_PUB_PEM }}
 
   daily-pytest-gpu:
     uses: ./.github/workflows/pytest-gpu.yaml

.github/workflows/pr-code-quality.yaml

@@ -0,0 +1,28 @@
+name: PR Code Quality Checks
+on:
+  push:
+    branches:
+    - dev
+    - main
+    - release/**
+  pull_request:
+  workflow_dispatch:
+# Cancel old runs when a new commit is pushed to the same branch if not on main
+# or dev
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+jobs:
+  code-quality:
+    uses: ./.github/workflows/code-quality.yaml
+    strategy:
+      matrix:
+        python_version:
+        - "3.9"
+        - "3.10"
+        - "3.11"
+        pip_deps:
+        - "[dev]"
+    with:
+      python_version: ${{ matrix.python_version }}
+      pip_deps: ${{ matrix.pip_deps }}

.github/workflows/pr-cpu.yaml

@@ -1,6 +1,6 @@
 name: PR CPU tests
 on:
-  pull_request_target:
+  pull_request:
   workflow_dispatch:
 # Cancel old runs when a new commit is pushed to the same branch if not on main
 # or dev
@@ -43,6 +43,3 @@ jobs:
     needs: [pytest-cpu]
     with:
       download-path: artifacts
-    secrets:
-      app_id: ${{ secrets.DEVOGE_BOT_PUB_APPID }}
-      private_key: ${{ secrets.DEVOGE_BOT_PUB_PEM }}

.github/workflows/smoketest.yaml

@@ -5,7 +5,7 @@ on:
     - dev
     - main
     - release/**
-  pull_request_target:
+  pull_request:
   workflow_call:
   workflow_dispatch:
 # Cancel old runs when a new commit is pushed to the same branch if not on main
@@ -27,21 +27,16 @@ jobs:
         - "3.10"
         - "3.11"
     steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-    - name: Get Repo Token
-      id: REPO_TOKEN
-      uses: tibdex/github-app-token@v1
+    - uses: actions/checkout@v3
+    - uses: actions/setup-python@v4
       with:
-        app_id: ${{ secrets.DEVOGE_BOT_PUB_APPID }}
-        private_key: ${{ secrets.DEVOGE_BOT_PUB_PEM }}
-    - name: Get composite run steps repository
-      uses: actions/checkout@v3
-      with:
-        repository: mosaicml/testing
-        ref: v0.0.2
-        path: ./testing
-        token: ${{ steps.REPO_TOKEN.outputs.token }}
-    - uses: ./testing/.github/actions/smoketest
-      with:
-        python_version: ${{ matrix.python_version }}
+        python-version: ${{ matrix.python_version }}
+    - name: Setup
+      run: |
+        set -ex
+        python -m pip install --upgrade 'pip<23' wheel
+        python -m pip install --upgrade .
+        python -m pip install pytest==7.2.1 pytest_codeblocks==0.16.1
+    - name: Run checks
+      run: |
+        pytest tests/test_smoketest.py