[ROCm] Pin pyenv clone to a fixed commit in Dockerfile.ms - #815
Open
magaonka-amd wants to merge 12 commits into
Open
magaonka-amd wants to merge 12 commits into
magaonka-amd wants to merge 12 commits into
Conversation
Extends the wheel test continuous and nightly release workflows to run against TheRock 7.13.0 and TheRock latest builds in addition to ROCm 7.2.0.
Consolidate the ROCm wheel RUNPATH strategy in jaxlib/rocm/rocm_rpath.bzl and embed it at link time via _WHEEL_RPATHS instead of a post-build patchelf step (applied under rocm_path_type=link_only, which the release wheel config sets). A single wheel resolves ROCm libs across TheRock pip wheels (1- and 2-deep $ORIGIN layouts), TheRock tarballs under /opt/rocm-<ver>, and legacy /opt/rocm; the loader silently skips $ORIGIN entries whose directories don't exist. Also pin the hermetic build ROCm to the image's TheRock version via ROCM_DISTRO_URL so the wheel's ROCm SONAMEs match the runtime image.
…n /opt/rocm-less images
- --device=/dev/dri exposes all 8 GPUs to every container on the node, defeating per-job GPU isolation on shared multi-GPU runners. - GPU isolation is already handled by --env-file /etc/podinfo/gha-gpu-isolation-settings, which sets ROCR_VISIBLE_DEVICES and HIP_VISIBLE_DEVICES per job. - --device=/dev/kfd is retained for KFD access; 8GPU jobs are unaffected since they own the whole node anyway.
- Add compute-post-suffix job to wheel_tests_rocm_release.yml for auto-detecting .postN versions from PyPI - Add wheel-version-suffix input for manual override - Update S3 paths to use release-validation/ convention with github.repository prefix, matching the layout from wheel_release_validation_rocm.yml - Update rocm_release_publish.yml to read from the new release-validation/ path and add repository input - Remove rocm_release_promote_gate.yml (gate pin no longer needed) Co-authored-by: tsrw2048 <239799652+tsrw2048@users.noreply.github.com>
Co-authored-by: Marco Minutoli <marco.minutoli@amd.com> Co-authored-by: gulsumgudukbay <gudukbay@gmail.com> Co-authored-by: magaonka <magaonka@amd.com> Co-authored-by: tsrw2048 <239799652+tsrw2048@users.noreply.github.com>
Dockerfile.ms cloned pyenv at floating master HEAD. Pin the clone to commit 135adbb (tag v2.8.0) so the pyenv version is explicit. Fixes ROCM-26967 / SEC-00814.
magaonka-amd
force-pushed
the
security/rocm-26967-pin-pyenv
branch
from
July 15, 2026 02:24
94e20c5 to
626eebe
Compare
magaonka-amd
force-pushed
the
amd-main
branch
3 times, most recently
from
August 10, 2026 00:17
acfa9f3 to
7643edc
Compare
magaonka-amd
force-pushed
the
amd-main
branch
10 times, most recently
from
August 17, 2026 22:49
2d7351c to
3aec073
Compare
magaonka-amd
force-pushed
the
amd-main
branch
2 times, most recently
from
August 20, 2026 18:51
79d884e to
ed8289a
Compare
magaonka-amd
force-pushed
the
amd-main
branch
4 times, most recently
from
September 2, 2026 21:33
360638e to
e156ed6
Compare
magaonka-amd
force-pushed
the
amd-main
branch
3 times, most recently
from
September 13, 2026 22:57
564a88e to
a53a18e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pin the pyenv clone in
build/rocm/Dockerfile.msto a fixed commit (135adbb192d32142a648cae7c2f7e491f5c57202, tagv2.8.0) instead of cloningmasterat floating HEAD.Why
The wheel-build container cloned
pyenv/pyenvat default-branch HEAD with no commit pin, then sourced its shell hooks into every subsequent build step. Reported by Mythos AI scan as SEC-00814 (ROCM-26967).Fixes ROCM-26967 / SEC-00814.