Change default permissions for github actions workflows to satisfy se…

…curity scorecard

PiperOrigin-RevId: 644434813

tensorflow/compiler/tests/async_comp_test.py

@@ -15,7 +15,6 @@
 """Tests for asynchronous compilation on the CPU and GPU devices."""
 
 import os
-import unittest
 
 from tensorflow.core.protobuf import config_pb2
 from tensorflow.python.client import session as session_lib
@@ -52,7 +51,6 @@ class AsyncCompilationTest(test.TestCase):
 
   # Asynchrobnous compilation uses the existing fallback path and existing
   # compiler. This test only tests that asynchronous compilation is performed.
-  @unittest.skip("b/263146341 - flaky Kokoro build.")
   def testAsyncCompilationJit(self):
 
     @function.Defun(compiled=True)

third_party/xla/.github/workflows/buildifier.yml

@@ -13,6 +13,7 @@
 # limitations under the License.
 # ============================================================================
 name: Buildifier
+permissions: read-all
 on:
   pull_request:
 

third_party/xla/.github/workflows/check_contents.yml

@@ -19,6 +19,7 @@
 # files once XLA moves out of Tensorflow internally.
 # TODO(ddunleavy): Update this after METADATA files are consolidated.
 name: Check Contents
+permissions: read-all
 on:
   pull_request:
 

third_party/xla/.github/workflows/clang_format.yml

@@ -14,6 +14,7 @@
 # ============================================================================
 
 name: Clang Format
+permissions: read-all
 on:
   pull_request:
 

third_party/xla/.github/workflows/rollback_notification.yml

@@ -13,6 +13,8 @@
 # limitations under the License.
 # ============================================================================
 name: Rollback Notification
+permissions:
+  pull-requests: write
 on:
   push:
     branches:
@@ -21,8 +23,6 @@ on:
 jobs:
   rollback-notification:
     if: contains(github.event.head_commit.message, 'revert')
-    permissions:
-      pull-requests: write
     runs-on: ubuntu-22.04
     defaults:
       run:

third_party/xla/.github/workflows/trusted-partners.yml

@@ -14,17 +14,18 @@
 # ==============================================================================
 
 name: Trusted Partner PR
+
+permissions:
+  # Needed to attach tags into the PR
+  issues: write
+  pull-requests: write
+
 on:
   pull_request_target:
 
 jobs:
   assign-partner-tags:
     runs-on: ubuntu-latest
-    permissions:
-      # Needed to attach tags into the PR
-      issues: write
-      contents: write
-      pull-requests: write
     if: |
       github.event.pull_request.draft == false &&
       github.event.sender.type == 'User'

third_party/xla/xla/pjrt/BUILD

@@ -593,6 +593,7 @@ cc_library(
         "@llvm-project//mlir:ReconcileUnrealizedCasts",
         "@llvm-project//mlir:Support",
         "@llvm-project//mlir:Transforms",
+        "@local_tsl//tsl/platform:statusor",
         "@stablehlo//:chlo_ops",
         "@stablehlo//:register",
         "@stablehlo//:stablehlo_ops",

third_party/xla/xla/pjrt/mlir_to_hlo.cc

@@ -16,6 +16,7 @@ limitations under the License.
 #include "xla/pjrt/mlir_to_hlo.h"
 
 #include <cstdint>
+#include <memory>
 #include <optional>
 #include <string>
 #include <utility>
@@ -61,6 +62,7 @@ limitations under the License.
 #include "xla/service/spmd/shardonnay/utils.h"
 #include "xla/translate/mhlo_to_hlo/mlir_hlo_to_hlo.h"
 #include "xla/util.h"
+#include "tsl/platform/statusor.h"
 
 namespace xla {
 
@@ -228,7 +230,6 @@ absl::Status MlirToXlaComputation(mlir::ModuleOp module,
     }
   }
 
-  HloProto proto;
   // TODO(b/345414638): Delete when we move Shardonnay as the first pass in the
   // XLA pipeline.
   if (use_tuple_args && GetDebugOptionsFromFlags().xla_use_shardonnay()) {
@@ -238,10 +239,16 @@ absl::Status MlirToXlaComputation(mlir::ModuleOp module,
                               mlir::StringAttr::get(context, "t"));
     use_tuple_args = false;
   }
-  TF_RETURN_IF_ERROR(
-      ConvertMlirHloToHlo(module, &proto, use_tuple_args, return_tuple));
 
-  xla_computation = XlaComputation(std::move(*proto.mutable_hlo_module()));
+  // create config options use use_tuple_args, return_tuple set:
+  mlir::MlirToHloConversionOptions options;
+  options.use_tuple_args = use_tuple_args;
+  options.return_tuple = return_tuple;
+
+  TF_ASSIGN_OR_RETURN(std::unique_ptr<HloModule> hlo_module,
+                      mlir::ConvertMlirHloToHloModule(module, options));
+
+  xla_computation = XlaComputation(hlo_module->ToProto());
   return absl::OkStatus();
 }
 

third_party/xla/xla/pjrt/pjrt_c_api_client.cc

@@ -1173,17 +1173,12 @@ PjRtCApiExecutable::GetHloModules() const {
       return xla::Internal("failed to convert to MHLO");
     // TODO(jieying): Tuple args should really come from GetCompileOptions (or
     // equivalent) once implemented.
-    TF_RETURN_IF_ERROR(mlir::ConvertMlirHloToHlo(module.get(), &hlo_proto,
-                                                 /*use_tuple_args=*/false,
-                                                 /*return_tuple=*/false));
-    xla::DebugOptions debug_options;
-    TF_ASSIGN_OR_RETURN(xla::HloModuleConfig module_config,
-                        xla::HloModule::CreateModuleConfigFromProto(
-                            hlo_proto.hlo_module(), debug_options));
+    mlir::MlirToHloConversionOptions options;
+    options.return_tuple = false;
+    TF_ASSIGN_OR_RETURN(std::unique_ptr<xla::HloModule> hlo_module,
+                        mlir::ConvertMlirHloToHloModule(module.get(), options));
+
     std::vector<std::shared_ptr<HloModule>> out;
-    TF_ASSIGN_OR_RETURN(
-        std::unique_ptr<HloModule> hlo_module,
-        HloModule::CreateFromProto(hlo_proto.hlo_module(), module_config));
     out.push_back(std::move(hlo_module));
     return out;
   }