Develop upstream sync 241210

.bazelrc

@@ -316,6 +316,14 @@ build:rocm --copt=-Wno-gnu-offsetof-extensions
 # to make it work with build_rocm_python3
 build:rocm --copt="-Wno-unused-result"
 
+build:rocm_clang_official --config=rocm
+build:rocm_clang_official --action_env=CLANG_COMPILER_PATH="/usr/lib/llvm-18/bin/clang"
+build:rocm_clang_official --action_env=TF_ROCM_CLANG="1"
+build:rocm_clang_official --linkopt="-fuse-ld=lld"
+build:rocm_clang_official --host_linkopt="-fuse-ld=lld"
+
+build:rocm_ci --config=rocm_clang_official
+
 build:sycl --crosstool_top=@local_config_sycl//crosstool:toolchain
 build:sycl --define=using_sycl=true
 build:sycl --define=tensorflow_mkldnn_contraction_kernel=0
@@ -401,6 +409,8 @@ build:windows --host_copt=-D_ENABLE_EXTENDED_ALIGNED_STORAGE
 # runfiles symlink tree to decide what to put into the Python wheel.
 startup --windows_enable_symlinks
 build:windows --enable_runfiles
+build:windows --nobuild_python_zip
+build:windows --dynamic_mode=off
 
 # Default paths for TF_SYSTEM_LIBS
 build:linux --define=PREFIX=/usr
@@ -474,6 +484,7 @@ build:avx_win --copt=/arch:AVX
 
 # Use Clang-cl compiler on Windows
 build:win_clang --copt=/clang:-Weverything
+build:win_clang --host_copt=/clang:-Weverything
 build:win_clang --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows-clang-cl
 build:win_clang --extra_execution_platforms=//tensorflow/tools/toolchains/win:x64_windows-clang-cl
 build:win_clang --host_platform=//tensorflow/tools/toolchains/win:x64_windows-clang-cl
@@ -485,6 +496,7 @@ test:win_clang --host_linkopt=/FORCE:MULTIPLE
 
 # Same config as above but for XLA, which has different toolchain paths
 build:win_clang_xla --copt=/clang:-Weverything
+build:win_clang_xla --host_copt=/clang:-Weverything
 build:win_clang_xla --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows-clang-cl
 build:win_clang_xla --extra_execution_platforms=//tools/toolchains/win:x64_windows-clang-cl
 build:win_clang_xla --host_platform=//tools/toolchains/win:x64_windows-clang-cl
@@ -861,10 +873,12 @@ build:macos_x86_pycpp_test --config=macos_x86_pycpp_test_filters -- //tensorflow
 build:cross_compile_macos_x86_pycpp_test --config=macos_x86_pycpp_test
 build:cross_compile_macos_x86_pycpp_test -//tensorflow/core/kernels:quantized_conv_ops_test -//tensorflow/core/kernels:quantized_matmul_op_test -//tensorflow/python/ops:quantized_conv_ops_test -//tensorflow/tools/graph_transforms:transforms_test -//tensorflow/python/tools:aot_compiled_test
 # WINDOWS X86-64 CPU PYCPP
+build:windows_x86_cpu_pycpp_test_build_opts --copt=/d2ReducedOptimizeHugeFunctions --host_copt=/d2ReducedOptimizeHugeFunctions --dynamic_mode=off
+build:windows_x86_cpu_pycpp_test_build_opts_debug --config=windows_x86_cpu_pycpp_test_build_opts --linkopt=/demangle:no --host_linkopt=/demangle:no --linkopt=/errorlimit:0 --host_linkopt=/errorlimit:0
 test:windows_x86_cpu_pycpp_test_filters --test_tag_filters=-no_windows,-windows_excluded,-no_oss,-oss_excluded,-gpu,-tpu,-benchmark-test
 test:windows_x86_cpu_pycpp_test_filters --build_tag_filters=-no_windows,-windows_excluded,-no_oss,-oss_excluded,-benchmark-test
 test:windows_x86_cpu_pycpp_test_filters --test_lang_filters=cc,py --test_size_filters=small,medium --test_timeout="300,450,1200,3600"
-test:windows_x86_cpu_pycpp_test_opts --copt=/d2ReducedOptimizeHugeFunctions --host_copt=/d2ReducedOptimizeHugeFunctions --dynamic_mode=off --build_tests_only
+test:windows_x86_cpu_pycpp_test_opts --config=windows_x86_cpu_pycpp_test_build_opts --build_tests_only
 test:windows_x86_cpu_pycpp_test --config=windows_x86_cpu_pycpp_test_opts --config=windows_x86_cpu_pycpp_test_filters -- //tensorflow/... -//tensorflow/java/... -//tensorflow/lite/... -//tensorflow/compiler/...
 
 # END TF TEST SUITE OPTIONS

.github/workflows/scorecards-analysis.yml

@@ -64,6 +64,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
+        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
         with:
           sarif_file: results.sarif

.github/workflows/sigbuild-docker-branch.yml

@@ -67,7 +67,7 @@ jobs:
       -
         name: Build and push
         id: docker_build
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
         with:
           push: true
           context: ./tensorflow/tools/tf_sig_build_dockerfiles

.github/workflows/sigbuild-docker-presubmit.yml

@@ -73,7 +73,7 @@ jobs:
       -
         name: Build containers, and push to GCR only if the 'build and push to gcr.io for staging' label is applied
         id: docker_build
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
         with:
           push: ${{ contains(github.event.pull_request.labels.*.name, 'build and push to gcr.io for staging') }}
           context: ./tensorflow/tools/tf_sig_build_dockerfiles

.github/workflows/sigbuild-docker.yml

@@ -82,7 +82,7 @@ jobs:
       -
         name: Build and push
         id: docker_build
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
         with:
           push: true
           context: ./tensorflow/tools/tf_sig_build_dockerfiles

.gitignore

@@ -29,6 +29,7 @@ tensorflow/contrib/cmake/_build/
 /estimator_api_init_files_list.txt
 *.whl
 dist
+venv/
 
 # Android
 .gradle

RELEASE.md

@@ -8,6 +8,16 @@
 
 * <DOCUMENT BREAKING CHANGES HERE>
 * <THIS SECTION SHOULD CONTAIN API, ABI AND BEHAVIORAL BREAKING CHANGES>
+* `LiteRT`, a.k.a. `tf.lite`:
+  * C++ API:
+    * The public constants `tflite::Interpreter:kTensorsReservedCapacity`
+      and `tflite::Interpreter:kTensorsCapacityHeadroom` are now const
+      references, rather than `constexpr` compile-time constants.
+      (This is to enable better API compatibility for TFLite in Play services
+      while preserving the implementation flexibility to change the values of
+      these constants in the future.)
+    * Interpreter:
+      * `tf.lite.Interpreter` gives deprecation warning redirecting to its new location at `ai_edge_litert.interpreter`, as the API `tf.lite.Interpreter` will be deleted in TF 2.20. See the [migration guide](https://ai.google.dev/edge/litert/migration) for details.
 
 ### Known Caveats
 
@@ -17,7 +27,8 @@
 
 ### Major Features and Improvements
 
-*   <INSERT MAJOR FEATURE HERE, USING MARKDOWN SYNTAX>
+*  `tf.lite`
+    * `tfl.Cast` op is now supporting `bfloat16` in runtime kernel.
 *   <IF RELEASE CONTAINS MULTIPLE FEATURES FROM SAME AREA, GROUP THEM TOGETHER>
 
 ### Bug Fixes and Other Changes

ci/official/containers/linux_arm64/build.sh

@@ -65,8 +65,10 @@ for target in jax tf; do
   fi
   set -e
 
-  if [[ -n "$KOKORO_BUILD_ID" ]]; then
-    gcloud auth configure-docker us-central1-docker.pkg.dev
-    docker push "$AR_IMAGE"
-  fi
+  INFRA_PUBLIC_TAG=infrastructure-public-image-$(docker images "$AR_IMAGE" --quiet)
+  AR_IMAGE_INFRA_PUBLIC="$AR_IMAGE_PATH:$INFRA_PUBLIC_TAG"
+  docker image tag "$AR_IMAGE" "$AR_IMAGE_INFRA_PUBLIC"
+
+  gcloud auth configure-docker us-central1-docker.pkg.dev
+  docker push "$AR_IMAGE_PATH" --all-tags
 done

ci/official/containers/ml_build/Dockerfile

@@ -52,7 +52,13 @@ RUN git clone --branch v1.11.0 https://github.com/bats-core/bats-core.git && bat
 RUN wget https://github.com/bazelbuild/bazelisk/releases/download/v1.21.0/bazelisk-linux-amd64 -O /usr/local/bin/bazel && chmod +x /usr/local/bin/bazel
 RUN wget https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-linux-amd64 -O /usr/local/bin/buildifier && chmod +x /usr/local/bin/buildifier
 RUN wget https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildozer-linux-amd64 -O /usr/local/bin/buildozer && chmod +x /usr/local/bin/buildozer
-RUN curl -sSL https://sdk.cloud.google.com > /tmp/gcloud && bash /tmp/gcloud --install-dir=~/usr/local/bin --disable-prompts
+
+RUN curl https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-linux-x86_64.tar.gz | \
+    tar zxf - google-cloud-sdk && \
+    google-cloud-sdk/install.sh --quiet && \
+    ln -s /google-cloud-sdk/bin/gcloud /usr/bin/gcloud
+ENV PATH="$PATH:/google-cloud-sdk/bin/"
+
 # Download and install patchelf v0.18.0 from GitHub. The default Ubuntu focal
 # packages only provide the "0.10-2build1" version. We use patchelf to manipulate
 # certain shared libraries during the wheel building process (https://github.com/tensorflow/tensorflow/blob/master/tensorflow/tools/pip_package/build_pip_package.sh#L255-L262).

ci/official/containers/ml_build_arm64/Dockerfile

@@ -0,0 +1,71 @@
+################################################################################
+FROM ubuntu:20.04@sha256:8e5c4f0285ecbb4ead070431d29b576a530d3166df73ec44affc1cd27555141b as devel
+################################################################################
+
+# Install devtoolset build dependencies
+COPY setup.sources.sh /setup.sources.sh
+COPY setup.packages.sh /setup.packages.sh
+COPY builder.packages.txt /builder.packages.txt
+
+RUN /setup.sources.sh && /setup.packages.sh /builder.packages.txt
+
+RUN update-ca-certificates
+# Install devtoolset-9 in /dt10 with glibc 2.17 and libstdc++ 4.8, for building
+# manylinux2014-compatible packages.
+COPY builder.devtoolset/fixlinks_aarch64.sh /fixlinks.sh
+COPY builder.devtoolset/rpm-patch.sh /rpm-patch.sh
+COPY builder.devtoolset/build_devtoolset.sh /build_devtoolset.sh
+COPY builder.devtoolset/gcc9-fixups.patch /gcc9-fixups.patch
+COPY builder.devtoolset/stringop_trunc.patch /stringop_trunc.patch
+
+RUN /build_devtoolset.sh devtoolset-10 /dt10
+
+# Build later version of patchelf that is not so buggy
+RUN wget https://github.com/NixOS/patchelf/releases/download/0.18.0/patchelf-0.18.0-aarch64.tar.gz && tar -zxvf patchelf-0.18.0-aarch64.tar.gz -C /usr && rm -rf patchelf-0.18.0-aarch64.tar.gz
+
+RUN curl https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-linux-arm.tar.gz | \
+    tar zxf - google-cloud-sdk && \
+    google-cloud-sdk/install.sh --quiet
+ENV PATH="$PATH:/google-cloud-sdk/bin/"
+
+# Install various tools.
+# - bats: bash unit testing framework
+#         NOTE: v1.6.0 seems to have a bug that made "git" in setup_file break
+# - bazelisk: always use the correct bazel version
+# - buildifier: clean bazel build depshttps://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-linux-arm64
+# - buildozer: clean bazel build deps
+RUN git clone --branch v1.11.0 https://github.com/bats-core/bats-core.git && bats-core/install.sh /usr/local && rm -rf bats-core
+RUN wget https://github.com/bazelbuild/bazelisk/releases/download/v1.21.0/bazelisk-linux-arm64 -O /usr/local/bin/bazel && chmod +x /usr/local/bin/bazel
+RUN wget https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-linux-arm64 -O /usr/local/bin/buildifier && chmod +x /usr/local/bin/buildifier
+RUN wget https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildozer-linux-arm64 -O /usr/local/bin/buildozer && chmod +x /usr/local/bin/buildozer
+
+RUN groupadd -g 1001 buildslave && useradd -m -u 1001 -g buildslave buildslave
+RUN mkdir -p /tf/venv
+RUN chown -R buildslave:buildslave /tf
+
+# All lines past this point are reset when $CACHEBUSTER is set. We need this
+# for Python specifically because we install some nightly packages which are
+# likely to change daily.
+ARG CACHEBUSTER=0
+RUN echo $CACHEBUSTER
+
+# Setup build and environment
+COPY devel.bashrc /root/.bashrc
+COPY ld.so.conf /dt10/etc/
+
+# Make sure clang is on the path
+RUN ln -s /usr/lib/llvm-18/bin/clang /usr/bin/clang
+
+# Setup JAX Python environment.
+COPY requirements.txt /requirements.txt
+COPY setup.python.sh /setup.python.sh
+RUN /setup.python.sh python3.9 requirements.txt
+RUN /setup.python.sh python3.10 requirements.txt
+RUN /setup.python.sh python3.11 requirements.txt
+RUN /setup.python.sh python3.12 requirements.txt
+RUN /setup.python.sh python3.13 requirements.txt
+
+# Python commands by default run under 3.11
+RUN ln -sf /usr/bin/python3.11 /usr/bin/python3
+RUN ln -sf /usr/bin/python3.11 /usr/bin/python
+RUN ln -sf /usr/lib/python3.11 /usr/lib/tf_python

ci/official/containers/ml_build_arm64/apt.conf

@@ -0,0 +1,15 @@
+/* Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+==============================================================================*/
+APT::Default-Release "focal";

ci/official/containers/ml_build_arm64/build.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+# Builds the following Docker images for Linux ARM64. See the accompanying
+# Dockerfile for more details:
+# - us-central1-docker.pkg.dev/tensorflow-sigs/ml-build-arm64:latest-multi-python
+
+set -exo pipefail
+
+function is_continuous_or_release() {
+  [[ "$KOKORO_JOB_TYPE" == "CONTINUOUS_INTEGRATION" ]] || [[ "$KOKORO_JOB_TYPE" == "RELEASE" ]]
+}
+
+# Move into the directory of the script
+cd "$(dirname "$0")"
+
+if is_continuous_or_release || [[ -z "$KOKORO_BUILD_ID" ]]; then
+  # A continuous job is the only one to publish to latest
+  TAG="latest"
+else
+  TAG=$(head -n 1 "$KOKORO_PIPER_DIR/presubmit_request.txt" | grep -oP "^presubmit_changelist: +\K(\d+)")
+fi
+
+AR_IMAGE_PATH="us-central1-docker.pkg.dev/tensorflow-sigs/tensorflow/ml-build-arm64"
+
+# Build for both JAX and TF usage.  We do these in one place because they share
+# almost all of the same cache layers
+export DOCKER_BUILDKIT=1
+AR_IMAGE="$AR_IMAGE_PATH:$TAG"
+docker pull "$AR_IMAGE" || true
+# Due to some flakiness of resources pulled in the build, allow the docker
+# command to reattempt build a few times in the case of failure (b/302558736)
+set +e
+for i in $(seq 1 5)
+do
+  docker build \
+  --build-arg REQUIREMENTS_FILE=jax.requirements.txt \
+  --cache-from "$AR_IMAGE" \
+  -t "$AR_IMAGE" . && break
+done
+final=$?
+if [ $final -ne 0 ]; then
+  exit $final
+fi
+set -e
+
+INFRA_PUBLIC_TAG=infrastructure-public-image-$(docker images "$AR_IMAGE" --quiet)
+AR_IMAGE_INFRA_PUBLIC="$AR_IMAGE_PATH:$INFRA_PUBLIC_TAG"
+docker image tag "$AR_IMAGE" "$AR_IMAGE_INFRA_PUBLIC"
+
+gcloud auth configure-docker us-central1-docker.pkg.dev
+docker push "$AR_IMAGE_PATH" --all-tags