This is an automated email from the ASF dual-hosted git repository.
tqchen pushed a commit to branch native-jenkins-groovy
in repository https://gitbox.apache.org/repos/asf/tvm.git
The following commit(s) were added to refs/heads/native-jenkins-groovy by this
push:
new e09cc37fea [REFACTOR][CI] Load shared pipelines only through Jenkins
SCM trust
e09cc37fea is described below
commit e09cc37fea78220cc07c3c62a59fd33ce3dd0f4f
Author: Tianqi Chen <[email protected]>
AuthorDate: Wed Oct 14 23:12:13 2026 +0000
[REFACTOR][CI] Load shared pipelines only through Jenkins SCM trust
---
ci/jenkins/README.md | 46 ++++++++++++--------------
ci/jenkins/generated/arm_jenkinsfile.groovy | 40 ++--------------------
ci/jenkins/generated/cpu_jenkinsfile.groovy | 40 ++--------------------
ci/jenkins/generated/docker_jenkinsfile.groovy | 40 ++--------------------
ci/jenkins/generated/gpu_jenkinsfile.groovy | 40 ++--------------------
ci/jenkins/generated/wasm_jenkinsfile.groovy | 40 ++--------------------
6 files changed, 31 insertions(+), 215 deletions(-)
diff --git a/ci/jenkins/README.md b/ci/jenkins/README.md
index 1294228054..ebf4e71b73 100644
--- a/ci/jenkins/README.md
+++ b/ci/jenkins/README.md
@@ -54,36 +54,32 @@ and the standalone skip commands retain their command-line
interfaces.
### Trust and rollout
-Each entry point first uses `readTrusted` to read the helper at Jenkins' pinned
-SCM revision. When an untrusted PR modifies that file, Jenkins refuses the
read.
-The entry point then checks out a fresh bootstrap workspace and reads the
helper
-from the fetched **PR target branch** in the canonical Apache repository. It
pins
-that exact target commit for all subsequent source merges, including release
-branch targets. It never evaluates workspace helper code or substitutes `main`.
-The bootstrap runs only built-in checkout/Git commands, without repository
scripts
-or credentials. Missing target files and evaluation errors fail the build.
-
-This fallback adds a bootstrap node allocation for a refused helper read; it
has
-the same spot-to-on-demand Exception fallback as preparation. Cancellation
still
-runs once before preparation. Trusted helper changes use Jenkins' selected
-revision directly. Host scripts and artifact metadata follow the pinned target
-revision for PR authors outside `CONTRIBUTORS.md`.
-
-Migrate each trusted target branch as a unit before testing untrusted PRs
against
-it. A target predating the shared helper cannot supply the fallback. An older
-helper or monolithic entry point may also call a renamed host script before the
-merge and trusted-file restoration, so a PR deleting that old path can fail
-preparation. This includes the node-information command moved into `scripts/`.
-A trusted branch build exercises the complete new layout; it does not establish
-compatibility with an unmigrated target. Do not bypass these failures by
loading
-PR-owned helpers or a different target revision.
+Each entry point evaluates the shared helper returned by `readTrusted` at
+Jenkins' selected SCM revision. Untrusted PRs that modify or delete the helper
+fail immediately, before node allocation, checkout, or credentials. Missing
+helpers, interrupted reads, and evaluation errors also propagate directly.
+No alternative helper is fetched or evaluated.
+
+Trusted helper changes use Jenkins' selected revision directly. Cancellation
+runs once before preparation. During preparation, the normal source merge pins
+the PR target revision for subsequent stages, including release targets.
+Host scripts and artifact metadata follow that pinned target revision for PR
+authors outside `CONTRIBUTORS.md`.
+
+Migrate each trusted target branch as a unit. An older monolithic entry point
+can call a renamed host script before the merge and trusted-file restoration,
+so a PR deleting that old path can fail preparation. This includes the
+node-information command moved into `scripts/`. Use a trusted branch build to
+exercise helper changes and the complete new layout; do not bypass a refused
+read by evaluating PR-owned code or a different target revision.
Before enabling the migration on production jobs, validate it with the existing
Jenkins plugin versions and sandbox settings on a trusted branch: run all five
entry points, suspend/resume across a node step, and exercise spot loss, a
normal
build-command failure, superseded builds, and a failed on-demand retry. Check
-trusted and untrusted PRs both with and without a common-helper change, and a
-release-target PR. Verify image overrides and disabled deployment gates before
+trusted helper changes, untrusted PRs without helper changes, and refusal of
+untrusted modified/deleted helpers, including a release-target PR. Verify image
+overrides and disabled deployment gates before
checking enabled docs/Docker deployment in the normal trusted deployment
context.
Local mocked execution checks pipeline control flow but cannot certify Jenkins
CPS serialization, sandbox approvals, SCM trust configuration, or real agent
loss.
diff --git a/ci/jenkins/generated/arm_jenkinsfile.groovy
b/ci/jenkins/generated/arm_jenkinsfile.groovy
index e70ce07525..1b7c0d733d 100644
--- a/ci/jenkins/generated/arm_jenkinsfile.groovy
+++ b/ci/jenkins/generated/arm_jenkinsfile.groovy
@@ -15,44 +15,8 @@
// specific language governing permissions and limitations
// under the License.
-// readTrusted pins trusted revisions, but rejects helper edits in untrusted
PRs.
-// In that case use the PR target, pinning the same commit for all source
merges.
-def helper
-String target_revision = null
-try {
- helper = readTrusted('ci/jenkins/generated/common.groovy')
-} catch (hudson.AbortException | java.io.FileNotFoundException ex) {
- if (!env.CHANGE_TARGET) throw ex
- echo 'Loading shared pipeline from the pinned PR target: ' + ex.toString()
- def from_target = { label ->
- node(label) {
- ws("workspace/exec_${env.EXECUTOR_NUMBER}/tvm/pipeline") {
- // No PR-owned executable or credentials run during this bootstrap.
- deleteDir()
- retry(5) { checkout scm }
- // Quote the branch as data and fetch only from the canonical
repository.
- def target = env.CHANGE_TARGET.replace("'", "'\"'\"'")
- sh(script: "git fetch https://github.com/apache/tvm.git
'refs/heads/${target}'",
- label: 'Fetch trusted pipeline target')
- def revision = sh(script: 'git rev-parse FETCH_HEAD', returnStdout:
true).trim()
- def source = sh(script: "git show
${revision}:ci/jenkins/generated/common.groovy",
- returnStdout: true)
- return [revision, source]
- }
- }
- }
- def pinned
- try {
- pinned = from_target('CPU-SMALL-SPOT')
- } catch (Exception failure) {
- pinned = from_target('CPU-SMALL')
- }
- target_revision = pinned[0]
- helper = pinned[1]
-}
-// Evaluation is outside the read/fetch fallback: script errors must propagate.
-ci = evaluate(helper)
-if (target_revision != null) ci.upstream_revision = target_revision
+// Reject untrusted helper edits before allocating nodes or running pipeline
steps.
+ci = evaluate(readTrusted('ci/jenkins/generated/common.groovy'))
ci.start()
ci.build('ARM-GRAVITON3', 'BUILD: arm', 'tvm/build-arm', images.ci_arm, 'arm')
{
diff --git a/ci/jenkins/generated/cpu_jenkinsfile.groovy
b/ci/jenkins/generated/cpu_jenkinsfile.groovy
index e252832c65..02c2c234b4 100644
--- a/ci/jenkins/generated/cpu_jenkinsfile.groovy
+++ b/ci/jenkins/generated/cpu_jenkinsfile.groovy
@@ -15,44 +15,8 @@
// specific language governing permissions and limitations
// under the License.
-// readTrusted pins trusted revisions, but rejects helper edits in untrusted
PRs.
-// In that case use the PR target, pinning the same commit for all source
merges.
-def helper
-String target_revision = null
-try {
- helper = readTrusted('ci/jenkins/generated/common.groovy')
-} catch (hudson.AbortException | java.io.FileNotFoundException ex) {
- if (!env.CHANGE_TARGET) throw ex
- echo 'Loading shared pipeline from the pinned PR target: ' + ex.toString()
- def from_target = { label ->
- node(label) {
- ws("workspace/exec_${env.EXECUTOR_NUMBER}/tvm/pipeline") {
- // No PR-owned executable or credentials run during this bootstrap.
- deleteDir()
- retry(5) { checkout scm }
- // Quote the branch as data and fetch only from the canonical
repository.
- def target = env.CHANGE_TARGET.replace("'", "'\"'\"'")
- sh(script: "git fetch https://github.com/apache/tvm.git
'refs/heads/${target}'",
- label: 'Fetch trusted pipeline target')
- def revision = sh(script: 'git rev-parse FETCH_HEAD', returnStdout:
true).trim()
- def source = sh(script: "git show
${revision}:ci/jenkins/generated/common.groovy",
- returnStdout: true)
- return [revision, source]
- }
- }
- }
- def pinned
- try {
- pinned = from_target('CPU-SMALL-SPOT')
- } catch (Exception failure) {
- pinned = from_target('CPU-SMALL')
- }
- target_revision = pinned[0]
- helper = pinned[1]
-}
-// Evaluation is outside the read/fetch fallback: script errors must propagate.
-ci = evaluate(helper)
-if (target_revision != null) ci.upstream_revision = target_revision
+// Reject untrusted helper edits before allocating nodes or running pipeline
steps.
+ci = evaluate(readTrusted('ci/jenkins/generated/common.groovy'))
ci.start()
ci.build('CPU', 'BUILD: CPU', 'tvm/build-cpu', images.ci_cpu, 'cpu') {
diff --git a/ci/jenkins/generated/docker_jenkinsfile.groovy
b/ci/jenkins/generated/docker_jenkinsfile.groovy
index a980ad31ca..0039be7712 100644
--- a/ci/jenkins/generated/docker_jenkinsfile.groovy
+++ b/ci/jenkins/generated/docker_jenkinsfile.groovy
@@ -15,44 +15,8 @@
// specific language governing permissions and limitations
// under the License.
-// readTrusted pins trusted revisions, but rejects helper edits in untrusted
PRs.
-// In that case use the PR target, pinning the same commit for all source
merges.
-def helper
-String target_revision = null
-try {
- helper = readTrusted('ci/jenkins/generated/common.groovy')
-} catch (hudson.AbortException | java.io.FileNotFoundException ex) {
- if (!env.CHANGE_TARGET) throw ex
- echo 'Loading shared pipeline from the pinned PR target: ' + ex.toString()
- def from_target = { label ->
- node(label) {
- ws("workspace/exec_${env.EXECUTOR_NUMBER}/tvm/pipeline") {
- // No PR-owned executable or credentials run during this bootstrap.
- deleteDir()
- retry(5) { checkout scm }
- // Quote the branch as data and fetch only from the canonical
repository.
- def target = env.CHANGE_TARGET.replace("'", "'\"'\"'")
- sh(script: "git fetch https://github.com/apache/tvm.git
'refs/heads/${target}'",
- label: 'Fetch trusted pipeline target')
- def revision = sh(script: 'git rev-parse FETCH_HEAD', returnStdout:
true).trim()
- def source = sh(script: "git show
${revision}:ci/jenkins/generated/common.groovy",
- returnStdout: true)
- return [revision, source]
- }
- }
- }
- def pinned
- try {
- pinned = from_target('CPU-SMALL-SPOT')
- } catch (Exception failure) {
- pinned = from_target('CPU-SMALL')
- }
- target_revision = pinned[0]
- helper = pinned[1]
-}
-// Evaluation is outside the read/fetch fallback: script errors must propagate.
-ci = evaluate(helper)
-if (target_revision != null) ci.upstream_revision = target_revision
+// Reject untrusted helper edits before allocating nodes or running pipeline
steps.
+ci = evaluate(readTrusted('ci/jenkins/generated/common.groovy'))
ci.start()
def ecr_push(full_name) {
diff --git a/ci/jenkins/generated/gpu_jenkinsfile.groovy
b/ci/jenkins/generated/gpu_jenkinsfile.groovy
index 8c98cd16cb..ea49bfab06 100644
--- a/ci/jenkins/generated/gpu_jenkinsfile.groovy
+++ b/ci/jenkins/generated/gpu_jenkinsfile.groovy
@@ -15,44 +15,8 @@
// specific language governing permissions and limitations
// under the License.
-// readTrusted pins trusted revisions, but rejects helper edits in untrusted
PRs.
-// In that case use the PR target, pinning the same commit for all source
merges.
-def helper
-String target_revision = null
-try {
- helper = readTrusted('ci/jenkins/generated/common.groovy')
-} catch (hudson.AbortException | java.io.FileNotFoundException ex) {
- if (!env.CHANGE_TARGET) throw ex
- echo 'Loading shared pipeline from the pinned PR target: ' + ex.toString()
- def from_target = { label ->
- node(label) {
- ws("workspace/exec_${env.EXECUTOR_NUMBER}/tvm/pipeline") {
- // No PR-owned executable or credentials run during this bootstrap.
- deleteDir()
- retry(5) { checkout scm }
- // Quote the branch as data and fetch only from the canonical
repository.
- def target = env.CHANGE_TARGET.replace("'", "'\"'\"'")
- sh(script: "git fetch https://github.com/apache/tvm.git
'refs/heads/${target}'",
- label: 'Fetch trusted pipeline target')
- def revision = sh(script: 'git rev-parse FETCH_HEAD', returnStdout:
true).trim()
- def source = sh(script: "git show
${revision}:ci/jenkins/generated/common.groovy",
- returnStdout: true)
- return [revision, source]
- }
- }
- }
- def pinned
- try {
- pinned = from_target('CPU-SMALL-SPOT')
- } catch (Exception failure) {
- pinned = from_target('CPU-SMALL')
- }
- target_revision = pinned[0]
- helper = pinned[1]
-}
-// Evaluation is outside the read/fetch fallback: script errors must propagate.
-ci = evaluate(helper)
-if (target_revision != null) ci.upstream_revision = target_revision
+// Reject untrusted helper edits before allocating nodes or running pipeline
steps.
+ci = evaluate(readTrusted('ci/jenkins/generated/common.groovy'))
ci.start()
ci.build('CPU', 'BUILD: GPU', 'tvm/build-gpu', images.ci_gpu, 'gpu') {
diff --git a/ci/jenkins/generated/wasm_jenkinsfile.groovy
b/ci/jenkins/generated/wasm_jenkinsfile.groovy
index 1887926335..ddf932529d 100644
--- a/ci/jenkins/generated/wasm_jenkinsfile.groovy
+++ b/ci/jenkins/generated/wasm_jenkinsfile.groovy
@@ -15,44 +15,8 @@
// specific language governing permissions and limitations
// under the License.
-// readTrusted pins trusted revisions, but rejects helper edits in untrusted
PRs.
-// In that case use the PR target, pinning the same commit for all source
merges.
-def helper
-String target_revision = null
-try {
- helper = readTrusted('ci/jenkins/generated/common.groovy')
-} catch (hudson.AbortException | java.io.FileNotFoundException ex) {
- if (!env.CHANGE_TARGET) throw ex
- echo 'Loading shared pipeline from the pinned PR target: ' + ex.toString()
- def from_target = { label ->
- node(label) {
- ws("workspace/exec_${env.EXECUTOR_NUMBER}/tvm/pipeline") {
- // No PR-owned executable or credentials run during this bootstrap.
- deleteDir()
- retry(5) { checkout scm }
- // Quote the branch as data and fetch only from the canonical
repository.
- def target = env.CHANGE_TARGET.replace("'", "'\"'\"'")
- sh(script: "git fetch https://github.com/apache/tvm.git
'refs/heads/${target}'",
- label: 'Fetch trusted pipeline target')
- def revision = sh(script: 'git rev-parse FETCH_HEAD', returnStdout:
true).trim()
- def source = sh(script: "git show
${revision}:ci/jenkins/generated/common.groovy",
- returnStdout: true)
- return [revision, source]
- }
- }
- }
- def pinned
- try {
- pinned = from_target('CPU-SMALL-SPOT')
- } catch (Exception failure) {
- pinned = from_target('CPU-SMALL')
- }
- target_revision = pinned[0]
- helper = pinned[1]
-}
-// Evaluation is outside the read/fetch fallback: script errors must propagate.
-ci = evaluate(helper)
-if (target_revision != null) ci.upstream_revision = target_revision
+// Reject untrusted helper edits before allocating nodes or running pipeline
steps.
+ci = evaluate(readTrusted('ci/jenkins/generated/common.groovy'))
ci.start()
ci.build('CPU', 'BUILD: WASM', 'tvm/build-wasm', images.ci_wasm, 'wasm') {
