mirror of
https://github.com/NVIDIA/Model-Optimizer.git
synced 2026-10-30 07:34:44 +08:00
Keval Morabia
1ccd945a51
`cuda-python` has mixed license and needs EStaff approval for usage. And till 0.42, it was only used in `examples/diffusers/cache_diffusion/pipeline` which has not been updated in 9 months and not used anymore hence removing. Also cherry-picked to `release/0.42.0` branch: https://github.com/NVIDIA/Model-Optimizer/pull/984 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Removed TensorRT/ONNX deployment and inference tooling, related model export/configuration, and runtime helpers from the cache-optimized diffusion examples; removed the cuda-python example dependency. * **Tests** * Removed the example benchmarking script and its associated benchmark test. * **Documentation** * Strengthened dependency-review, security, and PR guidance; updated PR template and contributing documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Keval Morabia <28916987+kevalmorabia97@users.noreply.github.com>
42 lines
2.1 KiB
YAML
42 lines
2.1 KiB
YAML
# Reference: https://docs.coderabbit.ai/getting-started/yaml-configuration
|
|
language: "en-US"
|
|
reviews:
|
|
profile: chill
|
|
collapse_walkthrough: true
|
|
poem: false
|
|
path_instructions:
|
|
- path: "modelopt/**/*.py"
|
|
instructions: &security_instructions |
|
|
Review all modelopt package and examples Python changes against the security coding practices in
|
|
SECURITY.md. Flag any of the following as CRITICAL security issues,
|
|
request changes, and fail the check if ANY are present:
|
|
1. torch.load(..., weights_only=False) with no inline comment justifying why it is safe
|
|
(e.g. confirming the file is internally-generated and not user-supplied).
|
|
2. numpy.load(..., allow_pickle=True) with no inline comment justifying why it is safe.
|
|
Should expose allow_pickle as a caller-configurable parameter defaulting to False, not hardcode True.
|
|
3. trust_remote_code=True hardcoded for transformers model or tokenizer loading.
|
|
Code should expose it as a caller-configurable parameter defaulting to False, not hardcode True.
|
|
4. eval() or exec() on any input that could originate from outside the process.
|
|
5. Any use of "# nosec" comments to bypass Bandit security checks is not allowed.
|
|
If a security-sensitive pattern is genuinely necessary, the PR must be reviewed and approved
|
|
by @NVIDIA/modelopt-setup-codeowners with an explicit justification in the PR description.
|
|
6. Any addition of new PIP dependencies in pyproject.toml or requirements.txt that are not
|
|
permissive licenses (e.g. MIT, Apache 2) must be reviewed and approved by
|
|
@NVIDIA/modelopt-setup-codeowners with an explicit justification in the PR description.
|
|
- path: "examples/**/*.py"
|
|
instructions: *security_instructions
|
|
auto_review:
|
|
auto_incremental_review: true
|
|
drafts: false
|
|
base_branches: ["main", "release/.*", "feature/.*"]
|
|
pre_merge_checks:
|
|
custom_checks:
|
|
- name: "Security anti-patterns"
|
|
mode: "error"
|
|
instructions: *security_instructions
|
|
knowledge_base:
|
|
code_guidelines:
|
|
filePatterns:
|
|
- "CONTRIBUTING.md"
|
|
- "SECURITY.md"
|