chore: import upstream snapshot with attribution

.bazelignore

@@ -0,0 +1,14 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================

.bazelversion

@@ -0,0 +1,2 @@
+7.7.0
+# NOTE: Update Bazel version in tensorflow/tools/ci_build/release/common.sh.oss

.clang-format

@@ -0,0 +1,4 @@
+# Run manually to reformat a file:
+# clang-format -i --style=file <file>
+BasedOnStyle: Google
+DerivePointerAlignment: false

.gemini/styleguide.md

@@ -0,0 +1,179 @@
+# TensorFlow PR Review Guidelines (Gemini Code Assist)
+
+## Objective
+
+Provide high-signal, technically rigorous, and actionable feedback on pull
+requests. Prioritize correctness, API stability, performance, security, and
+long-term maintainability while minimizing unnecessary or low-value comments.
+
+## Alignment with TensorFlow Contribution Guidelines
+
+This style guide is aligned with TensorFlow’s official contribution guidelines:
+https://github.com/tensorflow/tensorflow/blob/master/CONTRIBUTING.md
+
+The following rules are derived from TensorFlow contribution requirements and
+are used by Gemini Code Assist to guide PR review feedback.
+
+These include requirements such as mandatory test coverage, adherence to coding
+standards, API stability, and consistent behavior across supported environments.
+
+## Core Review Mindset
+
+### 1. Evaluate Necessity and Scope
+
+*   Is this change essential?
+*   Does it solve a real problem for TensorFlow users?
+*   Is it aligned with TensorFlow’s scope and design goals?
+*   Does it introduce unnecessary scope or complexity?
+*   Does the benefit justify the long-term maintenance cost?
+*   **Action:** If not, clearly question the need for the change.
+
+### 2. Challenge the Implementation
+
+*   Actively identify edge cases, failure scenarios, and incorrect assumptions.
+*   Validate tensor shapes, dtypes, and execution paths.
+*   Do not assume correctness based solely on passing tests.
+
+### 3. Ensure Robustness
+
+*   Flag fragile or environment-dependent logic.
+*   Identify risks across different hardware targets (CPU, GPU, TPU).
+*   Ensure proper error handling and defensive checks.
+
+### 4. Detect Low-Quality or Non-Idiomatic Code
+
+*   Identify overly generic, verbose, or context-insensitive code.
+*   Flag patterns that do not align with established TensorFlow practices.
+*   Highlight inconsistencies with existing repository patterns.
+
+### 5. Respect Existing Design Patterns
+
+*   Follow established TensorFlow APIs and architectural conventions.
+*   Avoid suggesting unnecessary abstractions or structural changes.
+*   Maintain consistency with similar modules.
+
+## Review Priorities
+
+### 1. Test Coverage and Reliability (Mandatory)
+
+*   Verify that unit tests are included for any new logic, feature, or bug fix.
+*   Flag PRs where source code is modified without adding or updating
+    corresponding tests.
+*   Ensure tests cover edge cases and expected behavior.
+*   Tests must be small, fast, and deterministic.
+*   Flag flaky tests or reliance on external systems (e.g., network, file
+    system).
+*   Ensure tests run reliably across supported platforms (Linux, macOS,
+    Windows).
+
+### 2. Code Quality and Formatting
+
+*   Enforce standard Python and C++ formatting conventions.
+*   Flag issues such as inconsistent indentation, poor variable naming, and
+    missing docstrings.
+*   Ensure code readability and consistency with repository standards.
+*   Formatting issues should be flagged, but feedback should remain concise and
+    avoid overwhelming developers with low-value comments.
+
+### 3. API Stability (High Priority)
+
+*   Flag breaking changes to public APIs (`tf.*`).
+*   Ensure backward compatibility is preserved.
+*   Verify adherence to the official deprecation lifecycle.
+*   Maintain consistency in naming and argument structure.
+
+### 4. Correctness and Numerical Behavior
+
+*   Validate tensor operations, shapes, and broadcasting logic.
+*   Identify potential numerical instability (e.g., overflow, underflow,
+    division by zero).
+
+### 5. Performance and Efficiency
+
+*   Flag Python-side loops over tensors and suggest vectorized TensorFlow
+    operations.
+*   Ensure compatibility with `tf.function` and avoid retracing issues.
+*   Identify unnecessary memory usage or redundant computations.
+*   Flag hardcoded device placement (e.g., `/gpu:0`).
+
+### 6. Security and Safe Execution
+
+*   Flag unsafe data handling, deserialization, or file operations.
+*   Highlight potential memory safety issues, especially in C++ kernels or
+    Python–C++ boundaries.
+*   Ensure code avoids patterns that could introduce security risks.
+
+### 7. Dependencies and Scope
+
+*   Flag the introduction of unnecessary or heavy external dependencies.
+*   Ensure the change aligns with TensorFlow’s scope and does not increase
+    maintenance burden unnecessarily.
+*   Flag large pull requests that combine multiple unrelated changes (e.g., bug
+    fix + refactor) and recommend splitting them into smaller, focused PRs for
+    easier review and maintainability.
+
+### 8. Readability and Maintainability
+
+*   Flag issues only when they affect clarity or long-term maintainability.
+*   Avoid suggesting purely subjective stylistic preferences that do not impact
+    readability or consistency.
+
+### 9. Idiomatic TensorFlow & Model Training
+
+*   **Data Pipelines:** Flag raw in-memory tensor training when dataset size or
+    scalability is a concern. \
+    Prefer `tf.data.Dataset` with `.batch()`, `.prefetch(tf.data.AUTOTUNE)`, and
+    optional `.cache()` where it fits in memory to improve performance.
+
+*   **Batching:** Ensure training uses appropriate batching (`batch_size` or
+    dataset batching). \
+    Avoid feeding the entire dataset at once unless it is trivially small.
+
+*   **Vectorization:** Avoid Python loops over tensors (training or inference).
+    \
+    Prefer batched/model-level operations (`model(x)` instead of per-sample
+    calls).
+
+*   **Reproducibility:** Require explicit seeds in data creation and model
+    initialization:
+
+    ```python
+    np.random.seed(0)
+    tf.random.set_seed(0)
+    ```
+
+*   **Observability:** Require validation data (`validation_split` or validation
+    dataset) and meaningful metrics (e.g., `mae`, `accuracy`) to monitor
+    training and detect overfitting.
+
+*   **Callbacks:** Encourage use of `tf.keras.callbacks.EarlyStopping` and
+    `tf.keras.callbacks.ModelCheckpoint` for stable and efficient training.
+
+## Out of Scope (Do Not Comment)
+
+*   Minor subjective stylistic preferences (e.g., personal formatting opinions)
+    that do not impact readability, consistency, or correctness.
+*   Trivial or non-impactful differences.
+
+## Feedback Standards
+
+*   Be clear, concise, and actionable.
+*   Provide concrete suggestions where possible.
+*   Avoid vague or non-specific feedback.
+*   **Bad:** "This might be slow."
+*   **Good:** "This loop introduces Python overhead; consider vectorized
+    TensorFlow operations to improve performance and enable better graph
+    optimization."
+
+## Review Guardrails
+
+*   Avoid speculative or uncertain feedback.
+*   Do not comment if no meaningful issue is identified.
+*   Avoid duplicate or redundant comments.
+*   Prioritize high-impact issues over minor observations.
+
+## Behavior
+
+*   Provide suggestions only (do not block pull requests).
+*   Focus on correctness, performance, security, and API stability.
+*   Maintain a high signal-to-noise ratio in all feedback.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,16 @@
+# Copyright 2025 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ============================================================================
+
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/tensorflow_issue_template.yaml

@@ -0,0 +1,141 @@
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+name: TensorFlow Issue Template
+description: Use this template to report TensorFlow-related issues
+body:
+  - type: dropdown
+    id: issue-type
+    attributes:
+      label: Issue type
+      description: What type of issue would you like to report?
+      multiple: false
+      options:
+        - Bug
+        - Build/Install
+        - Performance
+        - Support
+        - Feature Request
+        - Documentation Feature Request
+        - Documentation Bug
+        - Others
+    validations:
+      required: true
+  - type: markdown
+    attributes:
+      value: |
+        Please make sure that this is a bug. As per our [GitHub Policy](https://github.com/tensorflow/tensorflow/blob/master/ISSUES.md), we only address code/doc bugs, performance issues, feature requests and build/installation issues on GitHub.
+
+  - type: dropdown
+    id: tf-nightly
+    attributes:
+      label: Have you reproduced the bug with TensorFlow Nightly?
+      description: It is strongly suggested that you reproduce the bug with [TensorFlow Nightly](https://www.tensorflow.org/install/pip#nightly)
+      options:
+        - "Yes"
+        - "No"
+    validations:
+      required: true
+
+  - type: markdown
+    attributes:
+      value: |
+        You can collect some of this information using our [environment capture script](https://github.com/tensorflow/tensorflow/tree/master/tools/tf_env_collect.sh). You can also obtain the TensorFlow version with the following: <br> 1. TensorFlow 1.0: `python -c "import tensorflow as tf; print(tf.GIT_VERSION, tf.VERSION)"` <br>2. TensorFlow 2.0: `python -c "import tensorflow as tf; print(tf.version.GIT_VERSION, tf.version.VERSION)"`
+
+  - type: dropdown
+    id: source
+    attributes:
+      label: Source
+      description: TensorFlow installed from
+      options:
+        - source
+        - binary
+    validations:
+      required: true
+
+  - type: input
+    id: tfversion
+    attributes:
+      label: TensorFlow version
+      placeholder: e.g., tf 2.8
+    validations:
+      required: true
+  - type: dropdown
+    id: Code
+    attributes:
+      label: Custom code
+      options:
+        - "Yes"
+        - "No"
+    validations:
+      required: true
+  - type: input
+    id: OS
+    attributes:
+      label: OS platform and distribution
+      placeholder: e.g., Linux Ubuntu 16.04
+  - type: input
+    id: Mobile
+    attributes:
+      label: Mobile device
+      placeholder: e.g., Linux Ubuntu 16.04
+  - type: input
+    id: Python
+    attributes:
+      label: Python version
+      placeholder: e.g., 3.9
+  - type: input
+    id: Bazel
+    attributes:
+      label: Bazel version
+      description: If compiling from source
+  - type: input
+    id: Compiler
+    attributes:
+      label: GCC/compiler version
+      description: If compiling from source
+  - type: input
+    id: Cuda
+    attributes:
+      label: CUDA/cuDNN version
+  - type: input
+    id: Gpu
+    attributes:
+      label: GPU model and memory
+      description: If compiling from source
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: Current behavior?
+      description: Also tell us, what did you expect to happen?
+      placeholder: Tell us what you see!
+    validations:
+      required: true
+  - type: textarea
+    id: code-to-reproduce
+    attributes:
+      label: Standalone code to reproduce the issue
+      description: Provide a reproducible test case that is the bare minimum necessary to generate the problem. Please share a link to Colab, Jupyter, or any notebook.
+      placeholder: Tell us what you see!
+      value:
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log output
+      description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
+      render: shell

.github/ISSUE_TEMPLATE/tflite-converter-issue.md

@@ -0,0 +1,47 @@
+---
+name: TensorFlow Lite Converter Issue
+about: Use this template for reporting issues during model conversion to TFLite
+labels: 'TFLiteConverter'
+
+---
+
+### 1. System information
+
+- OS Platform and Distribution (e.g., Linux Ubuntu 16.04):
+- TensorFlow installation (pip package or built from source):
+- TensorFlow library (version, if pip package or github SHA, if built from source):
+
+### 2. Code
+
+Provide code to help us reproduce your issues using one of the following options:
+
+#### Option A: Reference colab notebooks
+
+1)  Reference [TensorFlow Model Colab](https://colab.research.google.com/gist/ymodak/e96a4270b953201d5362c61c1e8b78aa/tensorflow-datasets.ipynb?authuser=1): Demonstrate how to build your TF model.
+2)  Reference [TensorFlow Lite Model Colab](https://colab.research.google.com/gist/ymodak/0dfeb28255e189c5c48d9093f296e9a8/tensorflow-lite-debugger-colab.ipynb): Demonstrate how to convert your TF model to a TF Lite model (with quantization, if used) and run TFLite Inference (if possible).
+
+```
+(You can paste links or attach files by dragging & dropping them below)
+- Provide links to your updated versions of the above two colab notebooks.
+- Provide links to your TensorFlow model and (optionally) TensorFlow Lite Model.
+```
+
+#### Option B: Paste your code here or provide a link to a custom end-to-end colab
+
+```
+(You can paste links or attach files by dragging & dropping them below)
+- Include code to invoke the TFLite Converter Python API and the errors.
+- Provide links to your TensorFlow model and (optionally) TensorFlow Lite Model.
+```
+
+### 3. Failure after conversion
+If the conversion is successful, but the generated model is wrong, then state what is wrong:
+
+- Model produces wrong results and/or has lesser accuracy.
+- Model produces correct results, but it is slower than expected.
+
+### 4. (optional) RNN conversion support
+If converting TF RNN to TFLite fused RNN ops, please prefix [RNN] in the title.
+
+### 5. (optional) Any other info / logs
+Include any logs or source code that would be helpful to diagnose the problem. If including tracebacks, please include the full traceback. Large logs and files should be attached.

.github/ISSUE_TEMPLATE/tflite-in-play-services.md

@@ -0,0 +1,23 @@
+---
+name: TensorFlow Lite in Play Services issue
+about: Use this template for issues with TensorFlow Lite in Google Play Services
+labels: 'comp:lite-in-play-services'
+
+---
+
+**System information**
+- Android Device information (use `adb shell getprop ro.build.fingerprint`
+  if possible):
+- TensorFlow Lite in Play Services SDK version (found in `build.gradle`):
+- Google Play Services version
+  (`Settings` > `Apps` > `Google Play Services` > `App details`):
+
+**Standalone code to reproduce the issue**
+Provide a reproducible test case that is the bare minimum necessary to generate
+the problem. If possible, please share a link to or attach code demonstrating
+the problem.
+
+**Any other info / logs**
+Include any logs or source code that would be helpful to diagnose the problem.
+If including tracebacks, please include the full traceback. Large logs and files
+should be attached.

.github/ISSUE_TEMPLATE/tflite-op-request.md

@@ -0,0 +1,30 @@
+---
+name: TensorFlow Lite Op Request
+about: Use this template for reporting Lite ops you are using or missing
+labels: 'comp:lite'
+
+---
+
+**System information**
+- OS Platform and Distribution (e.g., Linux Ubuntu 16.04):
+- TensorFlow installed from (source or binary):
+- TensorFlow version (or github SHA if from source):
+
+
+**Provide the text output from tflite_convert**
+
+```
+# Copy and paste here
+```
+
+**Standalone code to reproduce the issue** 
+Provide a reproducible test case that is the bare minimum necessary to generate
+the problem. If possible, please share a link to Colab/Jupyter/any notebook.
+
+Also, please include a link to a GraphDef or the model if possible.
+
+**Any other info / logs**
+
+Include any logs or source code that would be helpful to diagnose the problem.
+If including tracebacks, please include the full traceback. Large logs and files
+should be attached.

.github/ISSUE_TEMPLATE/tflite-other.md

@@ -0,0 +1,62 @@
+name: TensorFlow Lite Other Issue description: Use this template to report any
+issue in TensorFlow Lite that is not about Converters, Play Services or Ops
+body: - type: dropdown id: issue-type attributes: label: Issue Type description:
+What type of issue would you like to report? multiple: false options: - Bug -
+Build/Install - Performance - Support - Feature Request - Documentation Feature
+Request - Documentation Bug - Others validations: required: true - type:
+markdown attributes: value: | Please make sure that this is a bug. As per our
+[GitHub Policy](https://github.com/tensorflow/tensorflow/blob/master/ISSUES.md),we
+only address code/doc bugs, performance issues, feature requests and
+build/installation issues on GitHub.
+
+-   type: markdown
+    attributes:
+      value: |
+        You can collect some of this information using our environment capture [script](https://github.com/tensorflow/tensorflow/tree/master/tools/tf_env_collect.sh)  You can also obtain the TensorFlow version with: <br> 1. TF 1.0: `python -c "import tensorflow as tf; print(tf.GIT_VERSION, tf.VERSION)"` <br>2. TF 2.0: `python -c "import tensorflow as tf; print(tf.version.GIT_VERSION, tf.version.VERSION)"`
+
+-   type: dropdown id: source attributes: label: Source description: Tensorflow
+    installed from options: - source - binary validations: required: true
+
+-   type: input id: tfversion attributes: label: Tensorflow Version description:
+    placeholder: ex,. tf 2.8 validations: required: true
+
+-   type: dropdown id: Code attributes: label: Custom Code description:
+    options: - "Yes" - "No" validations: required: true
+
+-   type: input id: OS attributes: label: OS Platform and Distribution
+    description: placeholder: e.g., Linux Ubuntu 16.04 validations: required:
+    false
+
+-   type: input id: Mobile attributes: label: Mobile device description:
+    placeholder: e.g., Linux Ubuntu 16.04 validations: required: false
+
+-   type: input id: Python attributes: label: Python version description:
+    placeholder: e.g., 3.9 validations: required: false
+
+-   type: input id: Bazel attributes: label: Bazel version description: if
+    compiling from source placeholder: validations: required: false
+
+-   type: input id: Compiler attributes: label: GCC/Compiler version
+    description: if compiling from source placeholder: validations: required:
+    false
+
+-   type: input id: Cuda attributes: label: CUDA/cuDNN version description:
+    placeholder: validations: required: false
+
+-   type: input id: Gpu attributes: label: GPU model and memory description: if
+    compiling from source placeholder: validations: required: false
+
+-   type: textarea id: what-happened attributes: label: Current Behaviour?
+    description: Also tell us, what did you expect to happen? placeholder: Tell
+    us what you see! value: "A bug happened!" render: shell validations:
+    required: true
+
+-   type: textarea id: code-to-reproduce attributes: label: Standalone code to
+    reproduce the issue description: Provide a reproducible test case that is
+    the bare minimum necessary to generate the problem. If possible, please
+    share a link to Colab/Jupyter/any notebook. placeholder: Tell us what you
+    see! value: render: shell validations: required: true
+
+-   type: textarea id: logs attributes: label: Relevant log output description:
+    Please copy and paste any relevant log output. This will be automatically
+    formatted into code, so no need for backticks. render: shell

.github/bot_config.yml

@@ -0,0 +1,98 @@
+# Copyright 2019 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ============================================================================
+
+# A list of assignees
+assignees:
+   - Venkat6871
+# A list of assignees for compiler folder
+compiler_assignees:
+   - joker-eph
+   - sanjoy
+# filesystem path
+filesystem_path:
+   - tensorflow/c/experimental/filesystem
+# security path
+security_path:
+   - tensorflow/security
+# words checklist
+segfault_memory:
+   - segfault
+   - memory leaks
+# assignees
+filesystem_security_assignee:
+   - mihaimaruseac
+   
+# Cuda Comment
+cuda_comment: >
+   From the template it looks like you are installing **TensorFlow** (TF) prebuilt binaries:
+      * For TF-GPU - See point 1
+      * For TF-CPU - See point 2
+   -----------------------------------------------------------------------------------------------
+   
+   **1. Installing **TensorFlow-GPU** (TF) prebuilt binaries**
+   
+   
+   Make sure you are using compatible TF and CUDA versions.
+   Please refer following TF version and CUDA version compatibility table.
+   
+   | TF  | CUDA |
+   
+   | :-------------: | :-------------: |
+   
+   | 2.5.0  | 11.2 |
+   
+   | 2.4.0  | 11.0 |
+   
+   | 2.1.0 - 2.3.0  | 10.1 |
+   
+   | 1.13.1 - 2.0  | 10.0  |
+   
+   | 1.5.0 - 1.12.0 | 9.0 |
+   
+     * If you have above configuration and using _**Windows**_ platform -
+       * Try adding the CUDA, CUPTI, and cuDNN installation directories to the %PATH% environment variable.
+       * Refer [windows setup guide](https://www.tensorflow.org/install/gpu#windows_setup).
+     * If you have above configuration and using _**Ubuntu/Linux**_ platform -
+       * Try adding the CUDA, CUPTI, and cuDNN installation directories to the $LD_LIBRARY_PATH environment variable.
+       * Refer [linux setup guide](https://www.tensorflow.org/install/gpu#linux_setup).
+     * If error still persists then, apparently your CPU model does not support AVX instruction sets.
+       * Refer [hardware requirements](https://www.tensorflow.org/install/pip#hardware-requirements).
+   
+   -----------------------------------------------------------------------------------------------
+   
+   **2. Installing **TensorFlow** (TF) CPU prebuilt binaries**
+   
+   
+   *TensorFlow release binaries version 1.6 and higher are prebuilt with AVX instruction sets.*
+   
+   
+   Therefore on any CPU that does not have these instruction sets, either CPU or GPU version of TF will fail to load.
+   
+   Apparently, your CPU model does not support AVX instruction sets. You can still use TensorFlow with the alternatives given below:
+   
+      * Try Google Colab to use TensorFlow.
+         * The easiest way to use TF will be to switch to [google colab](https://colab.sandbox.google.com/notebooks/welcome.ipynb#recent=true). You get pre-installed latest stable TF version. Also you can use ```pip install```  to install any other preferred TF version.
+         * It has an added advantage since you can you easily switch to different hardware accelerators (cpu, gpu, tpu) as per the task.
+         * All you need is a good internet connection and you are all set.
+      * Try to build TF from sources by changing CPU optimization flags.
+   
+   *Please let us know if this helps.*
+   
+windows_comment: >
+   From the stack trace it looks like you are hitting windows path length limit.
+      * Try to disable path length limit on Windows 10.
+        * Refer [disable path length limit instructions guide.](https://mspoweruser.com/ntfs-260-character-windows-10/)
+   
+   Please let us know if this helps.

.github/dependabot.yml

@@ -0,0 +1,45 @@
+# Copyright 2024 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ============================================================================
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker
+    directory: /ci/devinfra/docker_windows
+    schedule:
+      interval: monthly
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+
+  - package-ecosystem: docker
+    directory: /tensorflow/tools/gcs_test
+    schedule:
+      interval: monthly
+
+  - package-ecosystem: docker
+    directory: /tensorflow/tools/tf_sig_build_dockerfiles
+    schedule:
+      interval: monthly
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]

.github/workflows/arm-cd.yml

@@ -0,0 +1,71 @@
+# Copyright 2022 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+name: ARM CD
+
+on:
+  push:
+    tags:
+      - v2.**
+    branches:
+      - r2.**
+  schedule:
+    - cron: '0 8 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
+    runs-on: [self-hosted, linux, ARM64]
+    strategy:
+      fail-fast: false
+      matrix:
+        pyver: ['3.9', '3.10', '3.11', '3.12']
+    steps:
+      - name: Stop old running containers (if any)
+        shell: bash
+        run: |
+          running_containers=$(docker ps -q) && \
+          if [[ $running_containers == "" ]]; then
+            echo "No running containers";
+          else
+            echo "Running container(s) found" && \
+            docker stop $running_containers;
+          fi
+          docker container prune -f
+      - name: Clean repository
+        shell: bash
+        run: find /home/ubuntu/actions-runner/_work/tensorflow/tensorflow/. -name . -o -prune -exec sudo rm -rf -- {} + || true
+      - name: Checkout repository for nightly (skipped for releases)
+        if: ${{ github.event_name == 'schedule' }}
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: 'nightly'
+      - name: Checkout repository for releases (skipped for nightly)
+        if: ${{ github.event_name == 'push' }}
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Build and test pip wheel
+        shell: bash
+        run: |
+          is_nightly=0 && tf_project_name='tensorflow_cpu_aws' && ${{ github.event_name == 'schedule' }} && is_nightly=1 && tf_project_name='tf_nightly_cpu_aws'
+          echo "PyPI project name:" $tf_project_name
+          CI_DOCKER_BUILD_EXTRA_PARAMS="--build-arg py_major_minor_version=${{ matrix.pyver }} --build-arg is_nightly=${is_nightly} --build-arg tf_project_name=${tf_project_name}" \
+          ./tensorflow/tools/ci_build/ci_build.sh cpu.arm64 bash tensorflow/tools/ci_build/rel/ubuntu/cpu_arm64_test_build.sh
+      - name: Upload pip wheel to PyPI
+        if: github.event_name == 'schedule' || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v2')) # only if it is a scheduled nightly or tagged
+        shell: bash
+        run: python3 -m twine upload --verbose /home/ubuntu/actions-runner/_work/tensorflow/tensorflow/whl/* -u "__token__" -p ${{ secrets.AWS_PYPI_ACCOUNT_TOKEN }}

.github/workflows/arm-ci-extended-cpp.yml

@@ -0,0 +1,64 @@
+# Copyright 2022 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+name: ARM CI Extended C++
+
+on:
+  push:
+    tags:
+      - v2.**
+  schedule:
+    - cron: '0 2 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
+    runs-on: [self-hosted, linux, ARM64]
+    strategy:
+      matrix:
+        pyver: ['3.10']
+    steps:
+      - name: Stop old running containers (if any)
+        shell: bash
+        run: |
+          running_containers=$(docker ps -q) && \
+          if [[ $running_containers == "" ]]; then
+            echo "No running containers";
+          else
+            echo "Running container(s) found" && \
+            docker stop $running_containers;
+          fi
+          docker container prune -f
+          docker image prune -af
+      - name: Clean repository
+        shell: bash
+        run: find /home/ubuntu/actions-runner/_work/tensorflow/tensorflow/. -name . -o -prune -exec sudo rm -rf -- {} + || true
+      - name: Checkout repository for nightly (skipped for releases)
+        if: ${{ github.event_name == 'schedule' }}
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: 'nightly'
+      - name: Checkout repository
+        if: ${{ github.event_name == 'push' }}
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Build binary and run C++ tests
+        shell: bash
+        run: |
+          is_nightly=0 && tf_project_name='tf_ci_ext_c' && ${{ github.event_name == 'schedule' }} && is_nightly=1 && tf_project_name='tf_nightly_ci_ext_c'
+          CI_DOCKER_BUILD_EXTRA_PARAMS="--build-arg py_major_minor_version=${{ matrix.pyver }} --build-arg is_nightly=${is_nightly} --build-arg tf_project_name=${tf_project_name}" \
+          ./tensorflow/tools/ci_build/ci_build.sh cpu.arm64 bash tensorflow/tools/ci_build/rel/ubuntu/cpu_arm64_test_cpp.sh

.github/workflows/arm-ci-extended.yml

@@ -0,0 +1,65 @@
+# Copyright 2022 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+name: ARM CI Extended
+
+on:
+  push:
+    tags:
+      - v2.**
+  schedule:
+    - cron: '0 4 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
+    runs-on: [self-hosted, linux, ARM64]
+    strategy:
+      fail-fast: false
+      matrix:
+        pyver: ['3.9', '3.10', '3.11', '3.12']
+    steps:
+      - name: Stop old running containers (if any)
+        shell: bash
+        run: |
+          running_containers=$(docker ps -q) && \
+          if [[ $running_containers == "" ]]; then
+            echo "No running containers";
+          else
+            echo "Running container(s) found" && \
+            docker stop $running_containers;
+          fi
+          docker container prune -f
+          docker image prune -af
+      - name: Clean repository
+        shell: bash
+        run: find /home/ubuntu/actions-runner/_work/tensorflow/tensorflow/. -name . -o -prune -exec sudo rm -rf -- {} + || true
+      - name: Checkout repository for nightly (skipped for releases)
+        if: ${{ github.event_name == 'schedule' }}
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: 'nightly'
+      - name: Checkout repository
+        if: ${{ github.event_name == 'push' }}
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Build binary and run python tests on nightly for all python versions
+        shell: bash
+        run: |
+          is_nightly=0 && tf_project_name='tf_ci_ext' && ${{ github.event_name == 'schedule' }} && is_nightly=1 && tf_project_name='tf_nightly_ci_ext'
+          CI_DOCKER_BUILD_EXTRA_PARAMS="--build-arg py_major_minor_version=${{ matrix.pyver }} --build-arg is_nightly=${is_nightly} --build-arg tf_project_name=${tf_project_name}" \
+          ./tensorflow/tools/ci_build/ci_build.sh cpu.arm64 bash tensorflow/tools/ci_build/rel/ubuntu/cpu_arm64_test.sh

.github/workflows/arm-ci.yml

@@ -0,0 +1,55 @@
+# Copyright 2022 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+name: ARM CI
+
+on:
+  push:
+    branches:
+      - master
+      - r2.**
+permissions:
+  contents: read
+
+jobs:
+  build:
+    # Don't do this in forks, and if labeled, only for 'kokoro:force-run'
+    if: github.repository == 'tensorflow/tensorflow' && (github.event.action != 'labeled' || (github.event.action == 'labeled' && github.event.label.name == 'kokoro:force-run'))
+    runs-on: [self-hosted, linux, ARM64]
+    strategy:
+      matrix:
+        pyver: ['3.10']
+    steps:
+      - name: Stop old running containers (if any)
+        shell: bash
+        run: |
+          running_containers=$(docker ps -q) && \
+          if [[ $running_containers == "" ]]; then
+            echo "No running containers";
+          else
+            echo "Running container(s) found" && \
+            docker stop $running_containers;
+          fi
+          docker container prune -f
+      - name: Clean repository
+        shell: bash
+        run: find /home/ubuntu/actions-runner/_work/tensorflow/tensorflow/. -name . -o -prune -exec sudo rm -rf -- {} + || true
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Build binary and run python tests
+        shell: bash
+        run: |
+          CI_DOCKER_BUILD_EXTRA_PARAMS="--pull --build-arg py_major_minor_version=${{ matrix.pyver }} --build-arg is_nightly=1 --build-arg tf_project_name=tf_nightly_ci" \
+          ./tensorflow/tools/ci_build/ci_build.sh cpu.arm64 bash tensorflow/tools/ci_build/rel/ubuntu/cpu_arm64_test.sh

.github/workflows/build-reusable.yml

@@ -0,0 +1,73 @@
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+name: Reusable Build
+on:
+  workflow_call:
+    inputs:
+      runner:
+        description: 'Which runner should the workflow run on?'
+        required: true
+        type: string
+      tfci:
+        description: 'TFCI environment variable'
+        required: true
+        type: string
+      job_name:
+        description: 'Name of the job'
+        required: false
+        type: string
+        default: 'build-and-test'
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-test:
+    name: ${{ inputs.job_name }}
+    runs-on: ${{ inputs.runner }}
+    env:
+      PIP_NO_CACHE_DIR: 1
+    defaults:
+      run:
+        shell: bash
+    container: ${{ (contains(inputs.runner, 'linux-x86') && 'us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build:latest') ||
+                   (contains(inputs.runner, 'linux-arm64') && 'us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build-arm64:latest') ||
+                   (contains(inputs.runner, 'windows-x86') && null) }}
+    timeout-minutes: 300
+    steps:
+
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
+        env:
+          GIT_CONFIG_PARAMETERS: "'checkout.workers=12' 'core.featureManyFiles=true'"
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Build and test
+        env:
+          TFCI: ${{ inputs.tfci }}
+          TFCI_GITHUB_ACTIONS: true
+        run: ./ci/official/pycpp.sh
+
+      - name: Upload Profile
+        if: always()
+        continue-on-error: true
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: "profile-${{ github.workflow }}-${{ inputs.runner }}-${{ inputs.tfci }}-${{ github.run_number }}-${{ github.run_attempt }}"
+          path: build_output/profile.json.gz
+          if-no-files-found: warn

.github/workflows/cffconvert.yml

@@ -0,0 +1,38 @@
+# Copyright 2022 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+name: cffconvert
+
+on:
+  push:
+    paths:
+      - CITATION.cff
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
+    name: "validate"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out a copy of the repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: Check whether the citation metadata from CITATION.cff is valid
+        uses: citation-file-format/cffconvert-github-action@4cf11baa70a673bfdf9dad0acc7ee33b3f4b6084 # v2.0.0
+        with:
+          args: "--validate"

.github/workflows/check_license.yml

@@ -0,0 +1,56 @@
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ============================================================================
+name: License Check
+
+permissions: {}
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  license-check:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    timeout-minutes: 10
+    steps:
+      - name: "Checking out repository"
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: "Set up Go"
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: 'stable'
+      - name: "Run license check"
+        uses: google-ml-infra/actions/ci_check_license@432d36c6ac62d76fa99b3679758ccfbc10140fb6
+        with:
+          copyright-holder: 'The TensorFlow Authors'
+          license-type: 'apache'
+          exclude-paths: 'third_party'
+          exclude-files: >-
+            tensorflow_issue_template.yaml
+            BUILD
+            _redirects.yaml
+            cloudbuild.yaml
+            _index.yaml
+            _book.yaml
+            _toc.yaml
+            _doxygen.yaml
+          exclude-extensions: 'gradle'

.github/workflows/ci-build.yml

@@ -0,0 +1,61 @@
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - master
+      - r2.**
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  # Don't cancel in-progress jobs for master branches.
+  cancel-in-progress: ${{ github.ref != 'master' }}
+
+jobs:
+  build-linux-x86-cpu:
+    uses: ./.github/workflows/build-reusable.yml
+    with:
+      runner: 'linux-x86-n2-16'
+      tfci: 'py313,linux_x86,rbe,no_docker'
+
+  build-linux-x86-cuda:
+    uses: ./.github/workflows/build-reusable.yml
+    with:
+      runner: 'linux-x86-n2-16'
+      tfci: 'py313,linux_x86_cuda,rbe,no_docker'
+
+  build-linux-x86-cuda13:
+    uses: ./.github/workflows/build-reusable.yml
+    with:
+      runner: 'linux-x86-n2-16'
+      tfci: 'py313,linux_x86_cuda13_nvcc,rbe,no_docker'
+
+  build-arm64:
+    uses: ./.github/workflows/build-reusable.yml
+    with:
+      runner: 'linux-x86-n2-16'
+      tfci: 'py313,linux_arm64_cross_compile,rbe,no_docker,enable_pycpp_build'
+      job_name: 'build-only'
+
+  build-windows-x86:
+    uses: ./.github/workflows/build-reusable.yml
+    with:
+      runner: 'windows-x86-n2-16'
+      tfci: 'py313,windows_x86_ml_actions,rbe'

.github/workflows/create_issue.js

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * Copyright 2021 Google LLC. All Rights Reserved.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * =============================================================================
+ */
+
+/** Extracts PR from commit message and creates a GitHub Issue on Rollback of PR
+  Created issue is assigned to original PR owner and reviewer.
+
+  @param {!object}
+    github enables querying for PR and also create issue using rest endpoint
+    context has the commit message details in the payload
+  @return {string} Returns the issue number and title
+*/
+module.exports = async ({github, context}) => {
+  const rollback_commit = context.payload.head_commit.id;
+  const pr_match_groups = context.payload.head_commit.message.match(/\Rollback of PR #(\d+).*/) || [];
+  if (pr_match_groups.length != 2) {
+    console.log(`PR Number not found in ${context.payload.head_commit.message}`);
+    throw "Error extracting PR Number from commit message";
+  }
+  const pr_number = parseInt(pr_match_groups[1]);
+  const owner = context.payload.repository.owner.name;
+  const repo = context.payload.repository.name;
+  console.log(`Original PR: ${pr_number} and Rollback Commit: ${rollback_commit}`);
+  // Get the Original PR Details
+  const pr_resp = await github.rest.pulls.get({
+    owner,
+    repo,
+    pull_number: pr_number
+  });
+  if (pr_resp.status != 200 || pr_resp.data.state != 'closed') {
+    console.log(`PR:{pr_number} is not found or closed.  Not a valid condition to create an issue.`);
+    console.log(pr_resp);
+    throw `PR:{pr_number} needs to be valid and closed (merged)`;
+  }
+  const pr_title = pr_resp.data.title;
+  // Assign to PR owner and reviewers
+  const assignees = pr_resp.data.assignees.concat(pr_resp.data.requested_reviewers);
+  let assignee_logins = assignees.map(x => x.login);
+  assignee_logins.push(pr_resp.data.user.login);
+  console.log(assignee_logins);
+  // Create an new GH Issue and reference the Original PR
+  const resp = await github.rest.issues.create({
+    owner,
+    repo,
+    assignees: assignee_logins,
+    title: `Issue created for Rollback of PR #${pr_number}: ${pr_title}`,
+    body: `Merged PR #${pr_number} is rolled back in ${rollback_commit}.
+    Please follow up with the reviewer and close this issue once its resolved.`
+  });
+  return `Issue created: ${resp.data.number} with Title: ${resp.data.title}`;
+};

.github/workflows/gemini.yml

@@ -0,0 +1,39 @@
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+name: Gemini PR Review
+
+on:
+  pull_request:
+    types: [labeled]
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  gemini-review:
+    if: github.event.label.name == 'Needs Review'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Validate Gemini Review Trigger
+        run: |
+          echo "Needs Review label detected successfully."
+          echo "Gemini enterprise review pipeline triggered."
+          echo "Using style guide from .gemini/styleguide.md"

.github/workflows/issue-on-pr-rollback.yml

@@ -0,0 +1,43 @@
+# Copyright 2021 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+name: Creates a GitHub Issue when a PR Rolled back via Commit to Master
+on:
+  push:
+    branches:
+      - master
+      
+permissions: {}
+
+jobs:
+  create-issue-on-pr-rollback:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
+    if: |
+      github.repository == 'tensorflow/tensorflow' &&
+      startsWith(github.event.head_commit.message, 'Rollback of PR #')
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Create a new Github Issue
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{secrets.GITHUB_TOKEN}}
+          script: |
+            const script = require('./.github/workflows/create_issue.js')
+            console.log(await script({github, context}))

.github/workflows/osv-scanner-scheduled.yml

@@ -0,0 +1,40 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+name: OSV-Scanner Scheduled Scan
+
+on:
+  schedule:
+    - cron: 0 4 * * 1
+
+permissions:
+  # Require writing security events to upload SARIF file to security tab
+  security-events: write
+  # Only need to read contents
+  contents: read
+
+jobs:
+  scan-scheduled:
+    if: github.repository == 'tensorflow/tensorflow'
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.1"
+    with:
+      scan-args: |-
+        --lockfile=requirements.txt:./requirements_lock_3_9.txt
+        --lockfile=requirements.txt:./requirements_lock_3_10.txt
+        --lockfile=requirements.txt:./requirements_lock_3_11.txt
+        --lockfile=requirements.txt:./requirements_lock_3_12.txt
+        --lockfile=requirements.txt:./ci/official/containers/linux_arm64/devel.requirements.txt
+        --lockfile=requirements.txt:./ci/official/containers/linux_arm64/jax.requirements.txt
+        --lockfile=requirements.txt:./ci/official/containers/linux_arm64/devel.usertools/test.requirements.txt

.github/workflows/pylint-presubmit.yml

@@ -0,0 +1,50 @@
+# Copyright 2021 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+name: PyLint
+on:
+  pull_request:
+    paths:
+      - '**.py'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: PyLint
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - name: Get file changes
+      id: get_file_changes
+      uses: trilom/file-changes-action@a6ca26c14274c33b15e6499323aac178af06ad4b # v1.2.4
+      with:
+        output: ' '
+    - name: Report list of changed files
+      run: |
+        echo Changed files: ${{ steps.get_file_changes.outputs.files }}
+    - name: Set up Python 3.9
+      uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+      with:
+        python-version: "3.9"
+    - name: Install Python dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install pylint==2.13.9 numpy wheel
+    - name: Run PyLint on changed files
+      run: |
+        echo "${{ steps.get_file_changes.outputs.files}}" | tr " " "\n" | grep ".py$" | xargs pylint --rcfile=tensorflow/tools/ci_build/pylintrc

.github/workflows/release-branch-cherrypick.yml

@@ -0,0 +1,71 @@
+# Copyright 2022 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+# Usage: Go to
+# https://github.com/tensorflow/tensorflow/actions/workflows/release-branch-cherrypick.yml
+# and click "Run Workflow." Leave "Use Workflow From" set to "master", then
+# input the branch name and paste the cherry-pick commit and click Run. A PR
+# will be created.
+
+name: Release Branch Cherrypick
+on:
+  workflow_dispatch:
+    inputs:
+      # We use this instead of the "run on branch" argument because GitHub looks
+      # on that branch for a workflow.yml file, and we'd have to cherry-pick
+      # this file into those branches.
+      release_branch:
+        description: 'Release branch name (e.g. r2.9)'
+        required: true
+        type: string
+      git_commit:
+        description: 'Git commit to cherry-pick'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  cherrypick:
+    name: Cherrypick to ${{ github.event.inputs.release_branch}} - ${{ github.event.inputs.git_commit }}
+    runs-on: ubuntu-latest
+    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        ref: ${{ github.event.inputs.release_branch }}
+    - name: Get some helpful info for formatting
+      id: cherrypick
+      run: |
+          git config --global user.name "TensorFlow Release Automation"
+          git config --global user.email "jenkins@tensorflow.org"
+          git fetch origin master
+          git cherry-pick ${{ github.event.inputs.git_commit }}
+          echo "SHORTSHA=$(git log -1 ${{ github.event.inputs.git_commit }} --format="%h")" >> "$GITHUB_OUTPUT"
+          echo "TITLE=$(git log -1 ${{ github.event.inputs.git_commit }} --format="%s")" >> "$GITHUB_OUTPUT"
+    - name: Create Pull Request with changes
+      uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+      with:
+        title: '${{ github.event.inputs.release_branch }} cherry-pick: ${{ steps.cherrypick.outputs.SHORTSHA }} "${{ steps.cherrypick.outputs.TITLE }}"'
+        committer: TensorFlow Release Automation <jenkins@tensorflow.org>
+        token: ${{ secrets.JENKINS_TOKEN }}
+        base: ${{ github.event.inputs.release_branch }}
+        branch: ${{ github.event.inputs.release_branch }}-${{ steps.cherrypick.outputs.SHORTSHA }}
+        reviewers: learning-to-play
+        body: |
+          Refer to the original commit: https://github.com/tensorflow/tensorflow/commit/${{ github.event.inputs.git_commit }}
+

.github/workflows/scorecards-analysis.yml

@@ -0,0 +1,69 @@
+# Copyright 2022 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ============================================================================
+
+name: Scorecards supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '26 3 * * 2'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5
+        with:
+          sarif_file: results.sarif

.github/workflows/stale-issues.yml

@@ -0,0 +1,83 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ============================================================================
+
+name: Close inactive issues
+on:
+  schedule:
+    - cron: "30 1 * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  close-issues:
+    # Don't do this in forks
+    if: github.repository == 'tensorflow/tensorflow'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Awaiting response issues
+        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
+        with:
+          #Comma separated list of labels that can be assigned to issues to exclude them from being marked as stale
+          exempt-issue-labels: 'override-stale'
+          #Comma separated list of labels that can be assigned to PRs to exclude them from being marked as stale
+          exempt-pr-labels: "override-stale"
+          #Limit the No. of API calls in one run default value is 30.
+          operations-per-run: 1000
+          days-before-issue-stale: 7
+          days-before-issue-close: 7
+          stale-issue-label: "stale"
+          # reason for closed the issue default value is not_planned
+          close-issue-reason: completed
+          # List of labels to remove when issues/PRs unstale. 
+          labels-to-remove-when-unstale: 'stat:awaiting response'
+          only-labels: "stat:awaiting response"
+          stale-issue-message: > 
+            This issue is stale because it has been open for 7 days with no activity.
+            It will be closed if no further activity occurs. Thank you.
+          close-issue-message: >
+            This issue was closed because it has been inactive for 7 days since being marked as stale.
+            Please reopen if you'd like to work on this further.
+          days-before-pr-stale: 14
+          days-before-pr-close: 14
+          stale-pr-message: "This PR is stale because it has been open for 14 days with no activity. It will be closed if no further activity occurs. Thank you."
+          close-pr-message: "This PR was closed because it has been inactive for 14 days since being marked as stale. Please reopen if you'd like to work on this further."
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Contribution issues
+        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
+        with:
+          #Comma separated list of labels that can be assigned to issues to exclude them from being marked as stale
+          exempt-issue-labels: 'override-stale'
+          #Comma separated list of labels that can be assigned to PRs to exclude them from being marked as stale
+          exempt-pr-labels: "override-stale"
+          #Limit the No. of API calls in one run default value is 30.
+          operations-per-run: 1000
+          days-before-issue-stale: 180
+          days-before-issue-close: 365
+          stale-issue-label: "stale"
+          # reason for closed the issue default value is not_planned
+          close-issue-reason: completed
+          # List of labels to remove when issues/PRs unstale. 
+          labels-to-remove-when-unstale: "stat:contribution welcome,stat:good first issue"
+          any-of-labels: "stat:contribution welcome,stat:good first issue"
+          stale-issue-message: > 
+            This issue is stale because it has been open for 180 days with no activity.
+            It will be closed if no further activity occurs. Thank you.
+          close-issue-message: >
+            This issue was closed because it has been inactive for 1 year.
+          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/update-nightly.yml

@@ -0,0 +1,34 @@
+# Copyright 2019 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ============================================================================
+
+on:
+  workflow_dispatch:  # Allow manual triggers
+  schedule:
+    - cron: 0 4 * * *  # 4am UTC is 9pm PDT and 8pm PST
+name: Set nightly branch to master HEAD
+
+permissions: {}
+
+jobs:
+  master-to-nightly:
+    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+    - uses: zofrex/mirror-branch@0be56f4c8077a288a635a491b306ba0bb1c810e6 # v1.0.4
+      name: Set nightly branch to master HEAD
+      with:
+        target-branch: 'nightly'

.github/workflows/update-rbe.yml

@@ -0,0 +1,143 @@
+# Copyright 2022 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+
+# This Workflow updates tensorflow/tools/toolchains/remote_config/configs.bzl
+# to reference the most recent versions of the SIG Build Docker images.
+name: Update RBE Configs
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  rbe:
+    name: Update RBE Configs
+    runs-on: ubuntu-latest
+    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - name: Update the RBE Configs
+      run: |
+        function map() {
+          # The "digest" that allows us to pull an image is not the digest as
+          # returned by the API, but a sha256sum of the entire chunk of image
+          # metadata. gcr.io helpfully includes it in the header of the response
+          # as docker-content-digest: sha256:[digest]. Note we use egrep to
+          # match exactly sha256:<hash> because curl may include a ^M symbol at
+          # the end of the line.
+          # See https://cloud.google.com/architecture/using-container-images#exploring_image_manifests_digests_and_tags
+          echo -n "Trying to map name $1 to tag $2... "
+          digest=$(curl -s --head "https://gcr.io/v2/tensorflow-sigs/build/manifests/$2" | egrep -o "sha256:[[:alnum:]]*")
+          # Find the line matching the regex "sigbuild-r2.9" (with quotes) and
+          # replace just the digest portion in it
+          sed -i"" "/\"$1\"/ s/sha256:[[:alnum:]]*/$digest/g" tensorflow/tools/toolchains/remote_config/configs.bzl
+          echo "success."
+        }
+        # See https://github.com/tensorflow/tensorflow/blob/master/tensorflow/tools/toolchains/remote_config/configs.bzl
+        # This is a mapping of name_container_map keys under sigbuild_tf_configs
+        # to tag names on gcr.io/tensorflow-sigs/build.
+        # TF 2.9
+        map sigbuild-r2.9 2.9-python3.9
+        map sigbuild-r2.9-python3.8 2.9-python3.8
+        map sigbuild-r2.9-python3.9 2.9-python3.9
+        map sigbuild-r2.9-python3.10 2.9-python3.10
+        # TF 2.10
+        map sigbuild-r2.10 2.10-python3.9
+        map sigbuild-r2.10-python3.8 2.10-python3.8
+        map sigbuild-r2.10-python3.9 2.10-python3.9
+        map sigbuild-r2.10-python3.10 2.10-python3.10
+        # TF 2.11
+        map sigbuild-r2.11 2.11-python3.9
+        map sigbuild-r2.11-python3.8 2.11-python3.8
+        map sigbuild-r2.11-python3.9 2.11-python3.9
+        map sigbuild-r2.11-python3.10 2.11-python3.10
+        # WIP Clang Containers, used by TVCs
+        map sigbuild-57469 57469-python3.9
+        map sigbuild-57469-python3.8 57469-python3.8
+        map sigbuild-57469-python3.9 57469-python3.9
+        map sigbuild-57469-python3.10 57469-python3.10
+        # TF 2.12
+        map sigbuild-r2.12 2.12-python3.9
+        map sigbuild-r2.12-python3.8 2.12-python3.8
+        map sigbuild-r2.12-python3.9 2.12-python3.9
+        map sigbuild-r2.12-python3.10 2.12-python3.10
+        map sigbuild-r2.12-python3.11 2.12-python3.11
+        # TF 2.12 + Clang (containers are the same, but env vars in configs.bzl are different)
+        map sigbuild-r2.12-clang 2.12-python3.9
+        map sigbuild-r2.12-clang-python3.8 2.12-python3.8
+        map sigbuild-r2.12-clang-python3.9 2.12-python3.9
+        map sigbuild-r2.12-clang-python3.10 2.12-python3.10
+        map sigbuild-r2.12-clang-python3.11 2.12-python3.11
+        # TF 2.13
+        map sigbuild-r2.13 2.13-python3.9
+        map sigbuild-r2.13-python3.8 2.13-python3.8
+        map sigbuild-r2.13-python3.9 2.13-python3.9
+        map sigbuild-r2.13-python3.10 2.13-python3.10
+        map sigbuild-r2.13-python3.11 2.13-python3.11
+        # TF 2.13 + Clang (containers are the same, but env vars in configs.bzl are different)
+        map sigbuild-r2.13-clang 2.13-python3.9
+        map sigbuild-r2.13-clang-python3.8 2.13-python3.8
+        map sigbuild-r2.13-clang-python3.9 2.13-python3.9
+        map sigbuild-r2.13-clang-python3.10 2.13-python3.10
+        map sigbuild-r2.13-clang-python3.11 2.13-python3.11
+        # TF 2.14
+        map sigbuild-r2.14 2.14-python3.9
+        map sigbuild-r2.14-python3.9 2.14-python3.9
+        map sigbuild-r2.14-python3.10 2.14-python3.10
+        map sigbuild-r2.14-python3.11 2.14-python3.11
+        # TF 2.14 + Clang (containers are the same, but env vars in configs.bzl are different)
+        map sigbuild-r2.14-clang 2.14-python3.9
+        map sigbuild-r2.14-clang-python3.9 2.14-python3.9
+        map sigbuild-r2.14-clang-python3.10 2.14-python3.10
+        map sigbuild-r2.14-clang-python3.11 2.14-python3.11
+        # TF 2.16
+        map sigbuild-r2.16 2.16-python3.11
+        map sigbuild-r2.16-python3.9 2.16-python3.9
+        map sigbuild-r2.16-python3.10 2.16-python3.10
+        map sigbuild-r2.16-python3.11 2.16-python3.11
+        map sigbuild-r2.16-python3.12 2.16-python3.12
+        # TF 2.16 + Clang (containers are the same, but env vars in configs.bzl are different)
+        map sigbuild-r2.16-clang 2.16-python3.11
+        map sigbuild-r2.16-clang-python3.9 2.16-python3.9
+        map sigbuild-r2.16-clang-python3.10 2.16-python3.10
+        map sigbuild-r2.16-clang-python3.11 2.16-python3.11
+        map sigbuild-r2.16-clang-python3.12 2.16-python3.12
+        # TF 2.17
+        map sigbuild-r2.17 2.17-python3.11
+        map sigbuild-r2.17-python3.9 2.17-python3.9
+        map sigbuild-r2.17-python3.10 2.17-python3.10
+        map sigbuild-r2.17-python3.11 2.17-python3.11
+        map sigbuild-r2.17-python3.12 2.17-python3.12
+        # TF 2.17 + Clang (containers are the same, but env vars in configs.bzl are different)
+        map sigbuild-r2.17-clang 2.17-python3.11
+        map sigbuild-r2.17-clang-python3.9 2.17-python3.9
+        map sigbuild-r2.17-clang-python3.10 2.17-python3.10
+        map sigbuild-r2.17-clang-python3.11 2.17-python3.11
+        map sigbuild-r2.17-clang-python3.12 2.17-python3.12
+    - name: Create Pull Request with changes
+      uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+      with:
+        title: Update the RBE images to the latest container versions
+        committer: TensorFlow Release Automation <jenkins@tensorflow.org>
+        token: ${{ secrets.JENKINS_TOKEN }}
+        reviewers: mihaimaruseac,learning-to-play,nitins17
+        body: |
+          This PR was created by a GitHub Actions workflow to update all the SIG Build-based RBE containers to the most recent containers. See:
+
+          - https://github.com/tensorflow/tensorflow/blob/master/tensorflow/tools/toolchains/remote_config/configs.bzl
+          - https://github.com/tensorflow/tensorflow/blob/master/.github/workflows/update-rbe.yml

.gitignore

@@ -0,0 +1,54 @@
+MODULE.bazel.lock
+.DS_Store
+.ipynb_checkpoints
+node_modules
+/.bazelrc.user
+/.tf_configure.bazelrc
+/xla_configure.bazelrc
+/bazel-*
+/bazel_pip
+/tools/python_bin_path.sh
+/tensorflow/tools/git/gen
+/pip_test
+/_python_build
+*.pyc
+__pycache__
+*.swp
+.vscode/
+cmake_build/
+tensorflow/contrib/cmake/_build/
+.idea/**
+/build/
+[Bb]uild/
+/build_output/
+/tensorflow/core/util/version_info.cc
+/tensorflow/python/framework/fast_tensor_util.cpp
+/tensorflow/lite/gen/**
+/tensorflow/lite/tools/make/downloads/**
+/tensorflow/lite/tools/make/gen/**
+/api_init_files_list.txt
+/estimator_api_init_files_list.txt
+*.whl
+dist
+venv/
+
+# Android
+.gradle
+.idea
+*.iml
+local.properties
+gradleBuild
+
+# iOS
+*.pbxproj
+*.xcworkspace
+/*.podspec
+/tensorflow/lite/**/coreml/**/BUILD
+/tensorflow/lite/**/ios/BUILD
+/tensorflow/lite/**/objc/BUILD
+/tensorflow/lite/**/swift/BUILD
+/tensorflow/lite/examples/ios/simple/data/*.tflite
+/tensorflow/lite/examples/ios/simple/data/*.txt
+Podfile.lock
+Pods
+xcuserdata

.pylintrc

@@ -0,0 +1 @@
+tensorflow/tools/ci_build/pylintrc

.zenodo.json

@@ -0,0 +1,13 @@
+{
+    "description": "TensorFlow is an end-to-end open source platform for machine learning. It has a comprehensive, flexible ecosystem of tools, libraries, and community resources that lets researchers push the state-of-the-art in ML and developers easily build and deploy ML-powered applications.",
+    "license": "Apache-2.0",
+    "title": "TensorFlow",
+    "upload_type": "software",
+    "creators": [
+        {
+            "name": "TensorFlow Developers"
+        }
+    ],
+    "access_right": "open",
+    "notes": "Specific TensorFlow versions can be found in the \"Versions\" list on the right side of this page.<br>See the full list of authors <a href=\"https://github.com/tensorflow/tensorflow/graphs/contributors\">on GitHub</a>."
+}

AUTHORS

@@ -0,0 +1,11 @@
+# This is the official list of TensorFlow authors for copyright purposes.
+# This file is distinct from the CONTRIBUTORS files.
+# See the latter for an explanation.
+
+# Names should be added to this file as:
+# Name or Organization <email address>
+# The email address is not required for organizations.
+
+Google Inc.
+Yuan Tang <terrytangyuan@gmail.com>
+Arm Ltd

BUILD

@@ -0,0 +1,7 @@
+exports_files(glob(["requirements*"]) + [
+    "configure",
+    "configure.py",
+    "ACKNOWLEDGEMENTS",
+    "AUTHORS",
+    "LICENSE",
+])

CITATION.cff

@@ -0,0 +1,93 @@
+cff-version: 1.2.0
+message: "If you use TensorFlow in your research, please cite it using these metadata. Software is available from tensorflow.org."
+title: TensorFlow, Large-scale machine learning on heterogeneous systems
+abstract: TensorFlow is a machine learning system that operates at large scale and in heterogeneous environments. TensorFlow uses dataflow graphs to represent computation, shared state, and the operations that mutate that state. It maps the nodes of a dataflow graph across many machines in a cluster, and within a machine across multiple computational devices, including multicore CPUs, general purpose GPUs, and custom-designed ASICs known as Tensor Processing Units (TPUs). This architecture gives flexibility to the application developer, whereas in previous “parameter server” designs the management of shared state is built into the system, TensorFlow enables developers to experiment with novel optimizations and training algorithms. TensorFlow supports a variety of applications, with a focus on training and inference on deep neural networks. Several Google services use TensorFlow in production, we have released it as an open-source project, and it has become widely used for machine learning research. In this paper, we describe the TensorFlow dataflow model and demonstrate the compelling performance that TensorFlow achieves for several real-world applications.
+authors:
+  - family-names: Abadi
+    given-names: Martín
+  - family-names: Agarwal
+    given-names: Ashish
+  - family-names: Barham
+    given-names: Paul
+  - family-names: Brevdo
+    given-names: Eugene
+  - family-names: Chen
+    given-names: Zhifeng
+  - family-names: Citro
+    given-names: Craig
+  - family-names: Corrado
+    given-names: Greg S.
+  - family-names: Davis
+    given-names: Andy
+  - family-names: Dean
+    given-names: Jeffrey
+  - family-names: Devin
+    given-names: Matthieu
+  - family-names: Ghemawat
+    given-names: Sanjay
+  - family-names: Goodfellow
+    given-names: Ian
+  - family-names: Harp
+    given-names: Andrew
+  - family-names: Irving
+    given-names: Geoffrey
+  - family-names: Isard
+    given-names: Michael
+  - family-names: Jozefowicz
+    given-names: Rafal
+  - family-names: Jia
+    given-names: Yangqing
+  - family-names: Kaiser
+    given-names: Lukasz
+  - family-names: Kudlur
+    given-names: Manjunath
+  - family-names: Levenberg
+    given-names: Josh
+  - family-names: Mané
+    given-names: Dan
+  - family-names: Schuster
+    given-names: Mike
+  - family-names: Monga
+    given-names: Rajat
+  - family-names: Moore
+    given-names: Sherry
+  - family-names: Murray
+    given-names: Derek
+  - family-names: Olah
+    given-names: Chris
+  - family-names: Shlens
+    given-names: Jonathon
+  - family-names: Steiner
+    given-names: Benoit
+  - family-names: Sutskever
+    given-names: Ilya
+  - family-names: Talwar
+    given-names: Kunal
+  - family-names: Tucker
+    given-names: Paul
+  - family-names: Vanhoucke
+    given-names: Vincent
+  - family-names: Vasudevan
+    given-names: Vijay
+  - family-names: Viégas
+    given-names: Fernanda
+  - family-names: Vinyals
+    given-names: Oriol
+  - family-names: Warden
+    given-names: Pete
+  - family-names: Wattenberg
+    given-names: Martin
+  - family-names: Wicke
+    given-names: Martin
+  - family-names: Yu
+    given-names: Yuan
+  - family-names: Zheng
+    given-names: Xiaoqiang
+identifiers:
+  - type: doi
+    value: 10.5281/zenodo.4724125
+    description: The concept DOI for the collection containing all versions of the Citation File Format.
+date-released: "2015-11-09"
+license: "Apache-2.0"
+doi: 10.5281/zenodo.4724125
+ 

CODEOWNERS

@@ -0,0 +1,18 @@
+# Where component owners are known, add them here.
+
+/tensorflow/c/eager @qqfish
+/tensorflow/core/common_runtime/eager @qqfish
+/tenosrflow/core/debug @caisq
+/tensorflow/core/kernels/mkl/ @penpornk
+/tensorflow/core/kernels/sparse/ @penpornk
+/tensorflow/core/nccl/ @azaks2 @chsigg
+/tensorflow/python/autograph/ @mdanatg
+/tensorflow/python/debug @caisq
+/tensorflow/python/eager @rohan100jain
+/tensorflow/tools/docs/ @markdaoust
+/tensorflow/compiler/mlir/ @aminim
+/tensorflow/core/ir/ @aminim
+/tensorflow/core/transforms/ @aminim
+
+
+/third_party/systemlibs/ @perfinion

CODE_OF_CONDUCT.md

@@ -0,0 +1,79 @@
+# TensorFlow Code of Conduct
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to make participation in our project and our
+community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of
+experience, nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+*   Using welcoming and inclusive language.
+*   Being respectful of differing viewpoints and experiences.
+*   Gracefully accepting constructive criticism.
+*   Focusing on what is best for the community.
+*   Showing empathy towards other community members.
+
+Examples of unacceptable behavior by participants include:
+
+*   The use of sexualized language or imagery and unwelcome sexual attention or
+    advances.
+*   Trolling, insulting/derogatory comments, and personal or political attacks.
+*   Public or private harassment.
+*   Publishing others' private information, such as a physical or electronic
+    address, without explicit permission.
+*   Conduct which could reasonably be considered inappropriate for the forum in
+    which it occurs.
+
+All TensorFlow forums and spaces are meant for professional interactions, and any behavior which could reasonably be considered inappropriate in a professional setting is unacceptable.
+
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+
+## Scope
+
+This Code of Conduct applies to all content on tensorflow.org, TensorFlow’s GitHub organization, or any other official TensorFlow web presence allowing for community interactions, as well as at all official TensorFlow events, whether offline or online.
+
+The Code of Conduct also applies within project spaces and in public spaces whenever an individual is representing TensorFlow or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed or de facto representative at an online or offline event. 
+
+
+## Conflict Resolution
+
+Conflicts in an open source project can take many forms, from someone having a bad day and using harsh and hurtful language in the issue queue, to more serious instances such as sexist/racist statements or threats of violence, and everything in between.
+
+If the behavior is threatening or harassing, or for other reasons requires immediate escalation, please see below.
+
+However, for the vast majority of issues, we aim to empower individuals to first resolve conflicts themselves, asking for help when needed, and only after that fails to escalate further. This approach gives people more control over the outcome of their dispute. 
+
+If you are experiencing or witnessing conflict, we ask you to use the following escalation strategy to address the conflict:
+
+1.  Address the perceived conflict directly with those involved, preferably in a
+    real-time medium.
+2.  If this fails, get a third party (e.g. a mutual friend, and/or someone with
+    background on the issue, but not involved in the conflict) to intercede.
+3.  If you are still unable to resolve the conflict, and you believe it rises to
+    harassment or another code of conduct violation, report it.
+
+## Reporting Violations
+
+Violations of the Code of Conduct can be reported to TensorFlow’s Project Stewards, Thea Lamkin (thealamkin@google.com) and Joana Carrasqueira (joanafilipa@google.com). The Project Steward will determine whether the Code of Conduct was violated, and will issue an appropriate sanction, possibly including a written warning or expulsion from the project, project sponsored spaces, or project forums. We ask that you make a good-faith effort to resolve your conflict via the conflict resolution policy before submitting a report.
+
+Violations of the Code of Conduct can occur in any setting, even those unrelated to the project. We will only consider complaints about conduct that has occurred within one year of the report.
+
+
+## Enforcement
+
+If the Project Stewards receive a report alleging a violation of the Code of Conduct, the Project Stewards will notify the accused of the report, and provide them an opportunity to discuss the report before a sanction is issued. The Project Stewards will do their utmost to keep the reporter anonymous. If the act is ongoing (such as someone engaging in harassment), or involves a threat to anyone's safety (e.g. threats of violence), the Project Stewards may issue sanctions without notice.
+
+
+## Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant, version 1.4, available at https://contributor-covenant.org/version/1/4, and includes some aspects of the Geek Feminism Code of Conduct and the Drupal Code of Conduct.

CONTRIBUTING.md

@@ -0,0 +1,374 @@
+# Contributing guidelines
+
+## Pull Request Checklist
+
+Before sending your pull requests, make sure you do the following:
+
+-   Read the [contributing guidelines](CONTRIBUTING.md).
+-   Read the [Code of Conduct](CODE_OF_CONDUCT.md).
+-   Ensure you have signed the
+    [Contributor License Agreement (CLA)](https://cla.developers.google.com/).
+-   Check if your changes are consistent with the
+    [guidelines](#general-guidelines-and-philosophy-for-contribution).
+-   Changes are consistent with the [Coding Style](#c-coding-style).
+-   Run the [unit tests](#running-unit-tests).
+
+## How to become a contributor and submit your own code
+
+![Screen Shot 2022-08-30 at 7 27 04 PM](https://user-images.githubusercontent.com/42785357/187579207-9924eb32-da31-47bb-99f9-d8bf1aa238ad.png)
+
+### Typical Pull Request Workflow -
+
+**1. New PR**
+
+- As a contributor, you submit a New PR on GitHub.
+- We inspect every incoming PR and add certain labels to the PR such as `size:`,
+  `comp:` etc.  At this stage we check if the PR is valid and meets certain
+  quality requirements. For example, we check if the CLA is signed, PR has
+  sufficient description, if applicable unit tests are added, if it is a
+  reasonable contribution (meaning it is not a single liner cosmetic PR).
+
+**2. Valid?**
+
+-   If the PR passes all the quality checks then we go ahead and assign a
+    reviewer.
+-   If the PR didn't meet the validation criteria, we request for additional
+    changes to be made to PR to pass quality checks and send it back or on a
+    rare occasion we may reject it.
+
+**3. Review**
+
+-   For a valid PR, reviewer (person familiar with the code/functionality)
+    checks if the PR looks good or needs additional changes.
+-   If all looks good, the reviewer will approve the PR.
+-   If a change is needed, the contributor is requested to make the suggested
+    change.
+-   You make the change and submit it for the review again.
+-   This cycle repeats itself until the PR gets approved.
+-   Note: As a friendly reminder, we may reach out to you if the PR is awaiting
+    your response for more than 2 weeks.
+
+**4. Approved**
+
+-   Once the PR is approved, it gets `kokoro:force-run` label applied and it
+    initiates CI/CD tests.
+-   We can't move forward if these tests fail.
+-   In such situations, we may request you to make further changes to your PR
+    for the tests to pass.
+-   Once the tests pass, we now bring all the code into the internal code base,
+    using a job called "copybara".
+
+**5. Copy to Google Internal codebase and run internal CI**
+
+-   Once the PR is in the Google codebase, we make sure it integrates well with
+    its dependencies and the rest of the system.
+-   Rarely, If the tests fail at this stage, we cannot merge the code.
+-   If needed, we may come to you to make some changes. At times, it may not be
+    you, it may be us who may have hit a snag. Please be patient while we work
+    to fix this.
+-   Once the internal tests pass, we go ahead and merge the code internally as
+    well as externally on GitHub.
+
+In a graphical form, the entire lifetime of a PR looks like
+
+![image](https://github.com/tensorflow/tensorflow/assets/52792999/3eea4ca5-daa0-4570-b0b5-2a2b03a724a3)
+
+### Contributor License Agreements
+
+We'd love to accept your patches! Before we can take them, we have to jump a couple of legal hurdles.
+
+Please fill out either the individual or corporate Contributor License Agreement (CLA).
+
+  * If you are an individual writing original source code and you're sure you own the intellectual property, then you'll need to sign an [individual CLA](https://code.google.com/legal/individual-cla-v1.0.html).
+  * If you work for a company that wants to allow you to contribute your work, then you'll need to sign a [corporate CLA](https://code.google.com/legal/corporate-cla-v1.0.html).
+
+Follow either of the two links above to access the appropriate CLA and instructions for how to sign and return it. Once we receive it, we'll be able to accept your pull requests.
+
+***NOTE***: Only original source code from you and other people that have signed the CLA can be accepted into the main repository.
+
+### Contributing code
+
+If you have improvements to TensorFlow, send us your pull requests! For those
+just getting started, GitHub has a
+[how-to](https://help.github.com/articles/using-pull-requests/).
+
+TensorFlow team members will be assigned to review your pull requests. Once the
+pull requests are approved and pass continuous integration checks, a TensorFlow
+team member will apply `ready to pull` label to your change. This means we are
+working on getting your pull request submitted to our internal repository. After
+the change has been submitted internally, your pull request will be merged
+automatically on GitHub.
+
+If you want to contribute, start working through the TensorFlow codebase,
+navigate to the
+[GitHub "issues" tab](https://github.com/tensorflow/tensorflow/issues) and start
+looking through interesting issues. If you are not sure of where to start, then
+start by trying one of the smaller/easier issues here i.e.
+[issues with the "good first issue" label](https://github.com/tensorflow/tensorflow/labels/good%20first%20issue)
+and then take a look at the
+[issues with the "contributions welcome" label](https://github.com/tensorflow/tensorflow/labels/stat%3Acontributions%20welcome).
+These are issues that we believe are particularly well suited for outside
+contributions, often because we probably won't get to them right now. If you
+decide to start on an issue, leave a comment so that other people know that
+you're working on it. If you want to help out, but not alone, use the issue
+comment thread to coordinate.
+
+### Contribution guidelines and standards
+
+Before sending your pull request for
+[review](https://github.com/tensorflow/tensorflow/pulls),
+make sure your changes are consistent with the guidelines and follow the
+TensorFlow coding style.
+
+#### General guidelines and philosophy for contribution
+
+*   Include unit tests when you contribute new features, as they help to a)
+    prove that your code works correctly, and b) guard against future breaking
+    changes to lower the maintenance cost.
+*   Bug fixes also generally require unit tests, because the presence of bugs
+    usually indicates insufficient test coverage.
+*   Keep API compatibility in mind when you change code in core TensorFlow,
+    e.g., code in
+    [tensorflow/core](https://github.com/tensorflow/tensorflow/tree/master/tensorflow/core)
+    and
+    [tensorflow/python](https://github.com/tensorflow/tensorflow/tree/master/tensorflow/python).
+    TensorFlow has passed version 1.0 and hence cannot make
+    non-backward-compatible API changes without a major release. Reviewers of
+    your pull request will comment on any API compatibility issues
+    [following API review practices](https://github.com/tensorflow/community/blob/master/governance/api-reviews.md).
+*   When you contribute a new feature to TensorFlow, the maintenance burden is
+    (by default) transferred to the TensorFlow team. This means that the benefit
+    of the contribution must be compared against the cost of maintaining the
+    feature.
+*   Full new features (e.g., a new op implementing a cutting-edge algorithm)
+    typically will live in
+    [tensorflow/addons](https://github.com/tensorflow/addons) to get some
+    airtime before a decision is made regarding whether they are to be migrated
+    to the core.
+*   As every PR requires several CPU/GPU hours of CI testing, we discourage
+    submitting PRs to fix one typo, one warning,etc. We recommend fixing the
+    same issue at the file level at least (e.g.: fix all typos in a file, fix
+    all compiler warnings in a file, etc.)
+*   Tests should follow the
+    [testing best practices](https://www.tensorflow.org/community/contribute/tests)
+    guide.
+
+#### License
+
+Include a license at the top of new files.
+
+*   [C/C++ license example](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/framework/op.cc#L1)
+*   [Python license example](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/ops/nn.py#L1)
+*   [Java license example](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/java/src/main/java/org/tensorflow/Graph.java#L1)
+*   [Go license example](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/go/operation.go#L1)
+*   [Bash license example](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/tools/ci_build/ci_build.sh#L2)
+*   [JavaScript/TypeScript license example](https://github.com/tensorflow/tensorboard/blob/master/tensorboard/components/tf_backend/backend.ts#L1)
+
+Bazel BUILD files also need to include a license section, e.g.,
+[BUILD example](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/BUILD#L61).
+
+#### C++ coding style
+
+Changes to TensorFlow C++ code should conform to
+[Google C++ Style Guide](https://google.github.io/styleguide/cppguide.html).
+
+Use `clang-tidy` to check your C/C++ changes. To install `clang-tidy` on ubuntu:16.04, do:
+
+```bash
+apt-get install -y clang-tidy
+```
+
+You can check a C/C++ file by doing:
+
+
+```bash
+clang-format <my_cc_file> --style=google > /tmp/my_cc_file.cc
+diff <my_cc_file> /tmp/my_cc_file.cc
+```
+
+#### Python coding style
+
+Changes to TensorFlow Python code should conform to
+[Google Python Style Guide](https://github.com/google/styleguide/blob/gh-pages/pyguide.md)
+
+Use `pylint` to check your Python changes. To install `pylint` and check a file
+with `pylint` against TensorFlow's custom style definition:
+
+```bash
+pip install pylint
+pylint --rcfile=tensorflow/tools/ci_build/pylintrc myfile.py
+```
+
+Note `pylint --rcfile=tensorflow/tools/ci_build/pylintrc` should run from the
+top level tensorflow directory.
+
+#### Coding style for other languages
+
+*   [Google Java Style Guide](https://google.github.io/styleguide/javaguide.html)
+*   [Google JavaScript Style Guide](https://google.github.io/styleguide/jsguide.html)
+*   [Google Shell Style Guide](https://google.github.io/styleguide/shellguide.html)
+*   [Google Objective-C Style Guide](https://google.github.io/styleguide/objcguide.html)
+
+#### Running sanity check
+
+If you have Docker installed on your system, you can perform a sanity check on
+your changes by running the command:
+
+```bash
+tensorflow/tools/ci_build/ci_build.sh CPU tensorflow/tools/ci_build/ci_sanity.sh
+```
+
+This will catch most license, Python coding style and BUILD file issues that
+may exist in your changes.
+
+#### Running unit tests
+
+There are two ways to run TensorFlow unit tests.
+
+1.  Using tools and libraries installed directly on your system.
+
+    Refer to the
+    [CPU-only developer Dockerfile](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/tools/dockerfiles/dockerfiles/devel-cpu.Dockerfile)
+    and
+    [GPU developer Dockerfile](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/tools/dockerfiles/dockerfiles/devel-gpu.Dockerfile)
+    for the required packages. Alternatively, use the said
+    [tensorflow/build Docker images](https://hub.docker.com/r/tensorflow/build)
+    (`tensorflow/tensorflow:devel` and `tensorflow/tensorflow:devel-gpu` are no
+    longer supported for development). Use TF SIG Build Dockerfiles in
+    development to avoid installing the packages directly on your system (in
+    which case remember to change the directory from `/root` to `/tensorflow`
+    once you get into the running container so `bazel` can find the `tensorflow`
+    workspace).
+
+    you can do this by using the following command. As an example-
+
+    ```bash
+    docker run -it --rm -v $PWD:/tmp -w /tmp tensorflow/build:2.15-python3.10
+    ```
+
+    Once you have the packages installed, you can run a specific unit test in
+    bazel by doing as follows:
+
+    ```bash
+    export flags="--config=linux -k"
+    ```
+
+    If the tests are to be run on the GPU:
+
+    *   For TensorFlow versions starting from v.2.18.0: Add the `cuda` option
+        flag.
+
+        ```bash
+        export flags="--config=linux --config=cuda -k"
+        ```
+
+    *   For TensorFlow versions prior v.2.18.0: Add CUDA paths to
+        LD_LIBRARY_PATH and add the `cuda` option flag.
+
+        ```bash
+        export LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64:$LD_LIBRARY_PATH"
+        export flags="--config=linux --config=cuda -k"
+        ```
+
+    For example, to run all tests under tensorflow/python, do:
+
+    ```bash
+    bazel test ${flags} //tensorflow/python/...
+    ```
+
+    For a single component e.g. softmax op:
+
+    ```bash
+    bazel test ${flags} tensorflow/python/kernel_tests/nn_ops:softmax_op_test
+    ```
+
+    For a single/parameterized test e.g. `test_capture_variables` in
+    `tensorflow/python/saved_model/load_test.py`:
+
+    (Requires `python>=3.7`)
+
+    ```bash
+    bazel test ${flags} //tensorflow/python/saved_model:load_test --test_filter=*LoadTest.test_capture_variables*
+    ```
+
+    **Note:** You can add `--test_sharding_strategy=disabled` to the `flags` to
+    disable the sharding so that all the test outputs are in one file. However,
+    it may slow down the tests for not running in parallel and may cause the
+    test to timeout but it could be useful when you need to execute a single
+    test or more in general your filtered/selected tests have a very low
+    execution time and the sharding
+    [could create an overhead on the test execution](https://github.com/bazelbuild/bazel/issues/2113#issuecomment-264054799).
+
+2.  Using [Docker](https://www.docker.com) and TensorFlow's CI scripts.
+
+    ```bash
+    # Install Docker first, then this will build and run cpu tests
+    tensorflow/tools/ci_build/ci_build.sh CPU bazel test //tensorflow/...
+    ```
+
+    See
+    [TensorFlow Builds](https://github.com/tensorflow/tensorflow/tree/master/tensorflow/tools/ci_build)
+    for details.
+
+#### Running doctest for testable docstring
+
+There are two ways to test the code in the docstring locally:
+
+1.  If you are only changing the docstring of a class/function/method, then you
+    can test it by passing that file's path to
+    [tf_doctest.py](https://www.tensorflow.org/code/tensorflow/tools/docs/tf_doctest.py).
+    For example:
+
+    ```bash
+    python tf_doctest.py --file=<file_path>
+    ```
+
+    This will run it using your installed version of TensorFlow. To be sure
+    you're running the same code that you're testing:
+
+    *   Use an up to date [tf-nightly](https://pypi.org/project/tf-nightly/)
+        `pip install -U tf-nightly`
+    *   Rebase your pull request onto a recent pull from
+        [TensorFlow's](https://github.com/tensorflow/tensorflow) master branch.
+
+2.  If you are changing the code and the docstring of a class/function/method,
+    then you will need to
+    [build TensorFlow from source](https://www.tensorflow.org/install/source).
+    Once you are setup to build from source, you can run the tests:
+
+    ```bash
+    bazel run //tensorflow/tools/docs:tf_doctest
+    ```
+
+    or
+
+    ```bash
+    bazel run //tensorflow/tools/docs:tf_doctest -- --module=ops.array_ops
+    ```
+
+    The `--module` is relative to `tensorflow.python`.
+
+#### Debug builds
+
+When [building Tensorflow](https://www.tensorflow.org/install/source), passing
+`--config=dbg` to Bazel will build with debugging information and without
+optimizations, allowing you to use GDB or other debuggers to debug C++ code. For
+example, you can build the pip package with debugging information by running:
+
+```bash
+bazel build --config=dbg //tensorflow/tools/pip_package:build_pip_package
+```
+
+TensorFlow kernels and TensorFlow's dependencies are still not built with
+debugging information with `--config=dbg`, as issues occur on Linux if
+there is too much debug info (see [this GitHub
+issue](https://github.com/tensorflow/tensorflow/issues/48919) for context). If
+you want to debug a kernel, you can compile specific files with `-g` using the
+`--per_file_copt` bazel option. For example, if you want to debug the Identity
+op, which are in files starting with `identity_op`, you can run
+
+```bash
+bazel build --config=dbg --per_file_copt=+tensorflow/core/kernels/identity_op.*@-g //tensorflow/tools/pip_package:build_pip_package
+```
+
+Note that the `--config=dbg` option is not officially supported.

ISSUES.md

@@ -0,0 +1,11 @@
+If you open a GitHub Issue, here is our policy:
+
+1.  It must be a bug/performance issue or a feature request or a build issue or
+    a documentation issue (for small doc fixes please send a PR instead).
+1.  Make sure the Issue Template is filled out.
+1.  The issue should be related to the repo it is created in.
+
+**Here's why we have this policy:** We want to focus on the work that benefits
+the whole community, e.g., fixing bugs and adding features. Individual support
+should be sought on Stack Overflow or other non-GitHub channels. It helps us to
+address bugs and feature requests in a timely manner.

LICENSE

@@ -0,0 +1,251 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+## Some of TensorFlow's code is derived from Caffe, which is subject to the following copyright notice:
+
+COPYRIGHT
+
+All contributions by the University of California:
+
+Copyright (c) 2014, The Regents of the University of California (Regents)
+All rights reserved.
+
+All other contributions:
+
+Copyright (c) 2014, the respective contributors
+All rights reserved.
+
+Caffe uses a shared copyright model: each contributor holds copyright over
+their contributions to Caffe. The project versioning records all such
+contribution and copyright details. If a contributor wants to further mark
+their specific copyright on a particular contribution, they should indicate
+their copyright solely in the commit message of the change when it is
+committed.
+
+LICENSE
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+   ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+   (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+   LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+   ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+   SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+CONTRIBUTION AGREEMENT
+
+By contributing to the BVLC/caffe repository through pull-request, comment,
+or otherwise, the contributor releases their content to the
+license and copyright terms herein.

MODULE.bazel

@@ -0,0 +1,328 @@
+"""Experimental Bzlmod support for TensorFlow"""
+
+module(
+    name = "tensorflow",
+    repo_name = "org_tensorflow",
+)
+
+bazel_dep(name = "bazel_features", version = "1.36.0")
+bazel_dep(name = "abseil-cpp", version = "20260526.0", repo_name = "com_google_absl")
+single_version_override(
+    module_name = "abseil-cpp",
+    patch_strip = 1,
+    patches = [
+        "//third_party/absl:build_dll.patch",
+        "//third_party/absl:endian.patch",
+    ],
+)
+
+bazel_dep(name = "nlohmann_json", version = "3.12.0.bcr.1", repo_name = "nlohmann_json_lib")
+bazel_dep(name = "abseil-py", version = "2.1.0", repo_name = "absl_py")
+bazel_dep(name = "rules_python", version = "1.6.1")
+bazel_dep(name = "rules_shell", version = "0.6.1")
+bazel_dep(name = "bazel_skylib", version = "1.8.1")
+bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "rules_license", version = "1.0.0")
+bazel_dep(name = "rules_pkg", version = "1.0.1")
+bazel_dep(name = "rules_java", version = "8.16.1")
+bazel_dep(name = "rules_jvm_external", version = "6.8")
+bazel_dep(name = "protobuf", version = "31.1", repo_name = "com_google_protobuf")
+single_version_override(
+    module_name = "protobuf",
+    version = "31.1",
+)
+
+bazel_dep(name = "google_cloud_cpp", version = "3.0.0-rc1", repo_name = "com_github_googlecloudplatform_google_cloud_cpp")
+bazel_dep(name = "crc32c", version = "1.1.0", repo_name = "com_github_google_crc32c")
+bazel_dep(name = "brotli", version = "1.1.0", repo_name = "org_brotli")
+bazel_dep(name = "rules_cc", version = "0.2.11")
+bazel_dep(name = "curl", version = "8.11.0.bcr.5")
+bazel_dep(name = "rules_webtesting", version = "0.4.1", repo_name = "io_bazel_rules_webtesting")
+bazel_dep(name = "rules_closure", version = "0.15.0", repo_name = "io_bazel_rules_closure")
+bazel_dep(name = "grpc", version = "1.78.0", repo_name = "com_github_grpc_grpc")
+single_version_override(
+    module_name = "grpc",
+    patch_strip = 1,
+    patches = ["//third_party:grpc.patch"],
+    version = "1.78.0",
+)
+
+bazel_dep(name = "jsoncpp", version = "1.9.6", repo_name = "jsoncpp_git")
+bazel_dep(name = "rules_apple", version = "4.3.3", repo_name = "build_bazel_rules_apple")
+bazel_dep(name = "google_benchmark", version = "1.8.5", repo_name = "com_google_benchmark")
+bazel_dep(name = "rules_foreign_cc", version = "0.15.1")
+bazel_dep(name = "rules_proto", version = "7.1.0")
+bazel_dep(name = "zstd", version = "1.5.7", repo_name = "net_zstd")
+bazel_dep(name = "pybind11_bazel", version = "2.13.6")
+bazel_dep(name = "pybind11_protobuf", version = "0.0.0-20250210-f02a2b7")
+
+# NOTE: This is a newer version compared to what was used in WORKSPACE
+# and it breaks wheel tests.
+# TODO: Fix the incompatibility with wheel tests.
+bazel_dep(name = "pybind11_abseil", version = "202402.0")
+bazel_dep(name = "or-tools", version = "9.12", repo_name = "com_google_ortools")
+bazel_dep(name = "re2", version = "2024-07-02.bcr.1", repo_name = "com_googlesource_code_re2")
+bazel_dep(name = "rules_android", version = "0.6.6", repo_name = "build_bazel_rules_android")
+bazel_dep(name = "rules_android_ndk", version = "0.1.3")
+bazel_dep(name = "apple_support", version = "1.23.1", repo_name = "build_bazel_apple_support")
+bazel_dep(name = "rules_swift", version = "2.4.0")
+bazel_dep(name = "googletest", version = "1.17.0.bcr.1", repo_name = "com_google_googletest")
+bazel_dep(name = "fuzztest", version = "20250805.0", repo_name = "com_google_fuzztest")
+bazel_dep(name = "gflags", version = "2.2.2", repo_name = "com_github_gflags_gflags")
+bazel_dep(name = "snappy", version = "1.2.2.bcr.1")
+bazel_dep(name = "zlib", version = "1.3.1.bcr.7")
+bazel_dep(name = "libpng", version = "1.6.50.bcr.1", repo_name = "png")
+bazel_dep(name = "boringssl", version = "0.20250818.0")
+bazel_dep(name = "highway", version = "1.3.0", repo_name = "com_google_highway")
+single_version_override(
+    module_name = "highway",
+    patch_strip = 1,
+    patches = [
+        "//third_party/com_google_highway:build.patch",
+    ],
+)
+
+bazel_dep(name = "libprotobuf-mutator", version = "1.3", repo_name = "libprotobuf_mutator")
+bazel_dep(name = "rules_ml_toolchain")
+archive_override(
+    module_name = "rules_ml_toolchain",
+    integrity = "sha256-C0L2k6YMYFDYfbHgoOrrhKs/VBkfzglNhjNPrtyAfaA=",
+    strip_prefix = "rules_ml_toolchain-398d613aea7a4c294da49b79a6d6f3f8732bd84c",
+    urls = ["https://github.com/google-ml-infra/rules_ml_toolchain/archive/398d613aea7a4c294da49b79a6d6f3f8732bd84c.tar.gz"],
+)
+
+bazel_dep(name = "xla", repo_name = "xla")
+local_path_override(
+    module_name = "xla",
+    path = "third_party/xla",
+)
+
+tsl_extension = use_extension("@xla//third_party/extensions:tsl.bzl", "tsl_extension")
+use_repo(tsl_extension, tsl = "tsl")
+
+llvm = use_extension("@xla//third_party/extensions:llvm.bzl", "llvm_extension")
+use_repo(llvm, "llvm-project")
+
+xla_third_party = use_extension("@xla//third_party/extensions:third_party.bzl", "third_party_ext")
+use_repo(
+    xla_third_party,
+    "FP16",
+    "FXdiv",
+    "XNNPACK",
+    "compute_library",
+    "cpuinfo",
+    "cudnn_frontend_archive",
+    "cutlass_archive",
+    "dlpack",
+    "ducc",
+    "eigen_archive",
+    "farmhash_archive",
+    "farmhash_gpu_archive",
+    "gemmlowp",
+    "gloo",
+    "highwayhash",
+    "hwloc",
+    "implib_so",
+    "llvm-raw",
+    "llvm_openmp",
+    "mkl_dnn_acl_compatible",
+    "ml_dtypes_py",
+    "mpitrampoline",
+    "nanobind",
+    "nasm",
+    "nvshmem",
+    "onednn",
+    "onednn_async",
+    "pthreadpool",
+    "raft",
+    "riegeli",
+    "rocm_device_libs",
+    "shardy",
+    "slinky",
+    "stablehlo",
+    "tensorrt_oss_archive",
+    "triton",
+)
+
+tf_third_party = use_extension("//third_party/extensions:third_party.bzl", "third_party_ext")
+use_repo(
+    tf_third_party,
+    "arm_neon_2_x86_sse",
+    "com_github_googlecloudplatform_tensorflow_gcp_tools",
+    "com_google_googleapis",
+    "com_google_pprof",
+    "com_google_testing_compile",
+    "com_google_truth",
+    "com_squareup_javapoet",
+    "coremltools",
+    "cython",
+    "fft2d",
+    "flatbuffers",
+    "gif",
+    "hexagon_nn",
+    "icu",
+    "inception_v1",
+    "jpegxl",
+    "junit",
+    "kissfft",
+    "libjpeg_turbo",
+    "libwebp",
+    "linenoise",
+    "mobile_multibox",
+    "mobile_ssd",
+    "nccl_archive",
+    "nvtx_archive",
+    "opencl_headers",
+    "org_checkerframework_qual",
+    "org_hamcrest_core",
+    "org_sqlite",
+    "org_xprof",
+    "person_detect_data",
+    "ruy",
+    "six_archive",
+    "skcms",
+    "sobol_data",
+    "speech_commands",
+    "stylize",
+    "tf_runtime",
+    "tflite_conv_actions_frozen",
+    "tflite_mobilenet_float",
+    "tflite_mobilenet_quant",
+    "tflite_mobilenet_ssd",
+    "tflite_mobilenet_ssd_quant",
+    "tflite_mobilenet_ssd_quant_protobuf",
+    "tflite_ovic_testdata",
+    "vulkan_headers",
+    "xctestrunner",
+)
+
+# TODO: Remove this injection once xprof is updated.
+inject_repo(
+    tf_third_party,
+    com_github_nlohmann_json = "nlohmann_json_lib",
+)
+
+pybind11_internal_configure = use_extension(
+    "@pybind11_bazel//:internal_configure.bzl",
+    "internal_configure_extension",
+)
+use_repo(pybind11_internal_configure, "pybind11")
+
+python = use_extension("@rules_python//python/extensions:python.bzl", "python")
+python.defaults(
+    # The environment variable takes precedence if set.
+    python_version = "3.11",
+    python_version_env = "HERMETIC_PYTHON_VERSION",
+)
+python.toolchain(python_version = "3.10")
+python.toolchain(python_version = "3.11")
+python.toolchain(python_version = "3.12")
+python.toolchain(python_version = "3.13")
+
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+
+[pip.parse(
+    extra_hub_aliases = {
+        "numpy": ["numpy_headers"],
+    },
+    hub_name = "tf_pypi",
+    python_version = python_version,
+    requirements_lock = "//:requirements_lock_{}.txt".format(python_version.replace(".", "_")),
+    whl_modifications = {
+        "@pypi_mods//:numpy.json": "numpy",  # @pypi_mods is defined in XLA's MODULE.bazel
+    },
+) for python_version in [
+    "3.10",
+    "3.11",
+    "3.12",
+    "3.13",
+]]
+
+use_repo(pip, "pypi_mods", pypi = "tf_pypi")
+
+python_version_ext = use_extension("//third_party/extensions:python_version.bzl", "python_version_ext")
+use_repo(python_version_ext, "python_version_repo")
+
+git_configure = use_repo_rule("//third_party/git:git_configure.bzl", "git_configure")
+
+git_configure(name = "local_config_git")
+
+### RBE
+rbe_config = use_extension("@xla//third_party/extensions:rbe_config.bzl", "rbe_config_ext")
+use_repo(rbe_config, "ml_build_config_platform")
+
+register_execution_platforms("@local_config_platform//:host")
+
+remote_execution_configure = use_extension("@xla//third_party/extensions:remote_execution_configure.bzl", "remote_execution_configure_ext")
+use_repo(remote_execution_configure, "local_config_remote_execution")
+
+syslibs_configure = use_repo_rule("//third_party/systemlibs:syslibs_configure.bzl", "syslibs_configure")
+
+syslibs_configure(name = "local_config_syslibs")
+
+# register_toolchains("@local_config_python//:py_toolchain")
+
+cuda_configure = use_extension("@rules_ml_toolchain//extensions:cuda_configure.bzl", "cuda_configure_ext")
+use_repo(cuda_configure, "local_config_cuda")
+
+nccl_configure = use_extension("@rules_ml_toolchain//extensions:nccl_configure.bzl", "nccl_configure_ext")
+use_repo(nccl_configure, "local_config_nccl")
+
+sycl_configure = use_extension("@rules_ml_toolchain//extensions:sycl_configure.bzl", "sycl_configure_ext")
+use_repo(sycl_configure, "local_config_sycl")
+
+cuda_redist_init_ext = use_extension("@rules_ml_toolchain//extensions:cuda_redist_init.bzl", "cuda_redist_init_ext")
+use_repo(
+    cuda_redist_init_ext,
+    "cuda_cccl",
+    "cuda_cublas",
+    "cuda_cudart",
+    "cuda_cudnn",
+    "cuda_cufft",
+    "cuda_cupti",
+    "cuda_curand",
+    "cuda_cusolver",
+    "cuda_cusparse",
+    "cuda_driver",
+    "cuda_nvcc",
+    "cuda_nvjitlink",
+    "cuda_nvml",
+    "cuda_nvrtc",
+    "cuda_nvtx",
+)
+
+register_toolchains("@rules_ml_toolchain//cc:linux_x86_64_linux_x86_64")
+
+register_toolchains("@rules_ml_toolchain//cc:linux_x86_64_linux_x86_64_cuda")
+
+register_toolchains("@rules_ml_toolchain//cc:linux_aarch64_linux_aarch64")
+
+register_toolchains("@rules_ml_toolchain//cc:linux_aarch64_linux_aarch64_cuda")
+
+### Other local config repos
+rocm_configure = use_extension("@xla//third_party/extensions:rocm_configure.bzl", "rocm_configure_ext")
+use_repo(rocm_configure, "local_config_rocm")
+
+tensorrt_configure = use_extension("@xla//third_party/extensions:tensorrt_configure.bzl", "tensorrt_configure_ext")
+use_repo(tensorrt_configure, "local_config_tensorrt")
+
+nvidia_wheel_versions_repository = use_repo_rule(
+    "@xla//third_party/py:python_wheel.bzl",
+    "nvidia_wheel_versions_repository",
+)
+
+nvidia_wheel_versions_repository(
+    name = "nvidia_wheel_versions",
+    versions_source = "//ci/official/requirements_updater:nvidia-requirements.txt",
+)
+
+python_wheel_version_suffix_repository = use_repo_rule(
+    "@xla//third_party/py:python_wheel.bzl",
+    "python_wheel_version_suffix_repository",
+)
+
+python_wheel_version_suffix_repository(name = "tf_wheel_version_suffix")
+
+def_file_filter_configure = use_repo_rule("@xla//tools/def_file_filter:def_file_filter_configure.bzl", "def_file_filter_configure")
+
+def_file_filter_configure(name = "local_config_def_file_filter")

README.md

@@ -0,0 +1,168 @@
+<div align="center">
+  <img src="https://www.tensorflow.org/images/tf_logo_horizontal.png">
+</div>
+
+[![Python](https://img.shields.io/pypi/pyversions/tensorflow.svg)](https://badge.fury.io/py/tensorflow)
+[![PyPI](https://badge.fury.io/py/tensorflow.svg)](https://badge.fury.io/py/tensorflow)
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.4724125.svg)](https://doi.org/10.5281/zenodo.4724125)
+[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1486/badge)](https://bestpractices.coreinfrastructure.org/projects/1486)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/tensorflow/tensorflow/badge)](https://securityscorecards.dev/viewer/?uri=github.com/tensorflow/tensorflow)
+[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/tensorflow.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:tensorflow)
+[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/tensorflow-py.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:tensorflow-py)
+[![OSSRank](https://shields.io/endpoint?url=https://ossrank.com/shield/44)](https://ossrank.com/p/44)
+[![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-v1.4%20adopted-ff69b4.svg)](CODE_OF_CONDUCT.md)
+
+**`Documentation`** |
+------------------- |
+[![Documentation](https://img.shields.io/badge/api-reference-blue.svg)](https://www.tensorflow.org/api_docs/) |
+
+[TensorFlow](https://www.tensorflow.org/) is an end-to-end open source platform
+for machine learning. It has a comprehensive, flexible ecosystem of
+[tools](https://www.tensorflow.org/resources/tools),
+[libraries](https://www.tensorflow.org/resources/libraries-extensions), and
+[community](https://www.tensorflow.org/community) resources that lets
+researchers push the state-of-the-art in ML and developers easily build and
+deploy ML-powered applications.
+
+TensorFlow was originally developed by researchers and engineers working within
+the Machine Intelligence team at Google Brain to conduct research in machine
+learning and neural networks. However, the framework is versatile enough to be
+used in other areas as well.
+
+TensorFlow provides stable [Python](https://www.tensorflow.org/api_docs/python)
+and [C++](https://www.tensorflow.org/api_docs/cc) APIs, as well as a
+non-guaranteed backward compatible API for
+[other languages](https://www.tensorflow.org/api_docs).
+
+Keep up-to-date with release announcements and security updates by subscribing
+to
+[announce@tensorflow.org](https://groups.google.com/a/tensorflow.org/forum/#!forum/announce).
+See all the [mailing lists](https://www.tensorflow.org/community/forums).
+
+## Install
+
+See the [TensorFlow install guide](https://www.tensorflow.org/install) for the
+[pip package](https://www.tensorflow.org/install/pip), to
+[enable GPU support](https://www.tensorflow.org/install/gpu), use a
+[Docker container](https://www.tensorflow.org/install/docker), and
+[build from source](https://www.tensorflow.org/install/source).
+
+To install the current release, which includes support for
+[CUDA-enabled GPU cards](https://www.tensorflow.org/install/gpu) *(Ubuntu and
+Windows)*:
+
+```
+ pip install tensorflow
+```
+
+Other devices (DirectX and MacOS-metal) are supported using
+[Device Plugins](https://www.tensorflow.org/install/gpu_plugins#available_devices).
+
+A smaller CPU-only TensorFlow package is also available:
+
+```
+ pip install tensorflow-cpu
+```
+
+To update TensorFlow to the latest version, add the `--upgrade` flag to the
+commands above.
+
+*Nightly binaries are available for testing using the
+[tf-nightly](https://pypi.python.org/pypi/tf-nightly) and
+[tf-nightly-cpu](https://pypi.python.org/pypi/tf-nightly-cpu) packages on PyPI.*
+
+#### *Try your first TensorFlow program*
+
+```shell
+$ python
+```
+
+```python
+>>> import tensorflow as tf
+>>> tf.add(1, 2).numpy()
+3
+>>> hello = tf.constant('Hello, TensorFlow!')
+>>> hello.numpy()
+b'Hello, TensorFlow!'
+```
+
+For more examples, see the
+[TensorFlow Tutorials](https://www.tensorflow.org/tutorials/).
+
+## Contribution guidelines
+
+**If you want to contribute to TensorFlow, be sure to review the
+[Contribution Guidelines](CONTRIBUTING.md). This project adheres to TensorFlow's
+[Code of Conduct](CODE_OF_CONDUCT.md). By participating, you are expected to
+uphold this code.**
+
+**We use [GitHub Issues](https://github.com/tensorflow/tensorflow/issues) for
+tracking requests and bugs, please see
+[TensorFlow Forum](https://discuss.tensorflow.org/) for general questions and
+discussion, and please direct specific questions to
+[Stack Overflow](https://stackoverflow.com/questions/tagged/tensorflow).**
+
+The TensorFlow project strives to abide by generally accepted best practices in
+open-source software development.
+
+## Patching guidelines
+
+Follow these steps to patch a specific version of TensorFlow, for example, to
+apply fixes to bugs or security vulnerabilities:
+
+*   Clone the TensorFlow repository and switch to the appropriate branch for
+    your desired version—for example, `r2.8` for version 2.8.
+*   Apply the desired changes (i.e., cherry-pick them) and resolve any code
+    conflicts.
+*   Run TensorFlow tests and ensure they pass.
+*   [Build](https://www.tensorflow.org/install/source) the TensorFlow pip
+    package from source.
+
+## Continuous build status
+
+You can find more community-supported platforms and configurations in the
+[TensorFlow SIG Build Community Builds Table](https://github.com/tensorflow/build#community-supported-tensorflow-builds).
+
+### Official Builds
+
+Build Type                    | Status                                                                                                                                                                           | Artifacts
+----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------
+**Linux CPU**                 | [![Status](https://storage.googleapis.com/tensorflow-kokoro-build-badges/ubuntu-cc.svg)](https://storage.googleapis.com/tensorflow-kokoro-build-badges/ubuntu-cc.html)           | [PyPI](https://pypi.org/project/tf-nightly/)
+**Linux GPU**                 | [![Status](https://storage.googleapis.com/tensorflow-kokoro-build-badges/ubuntu-gpu-py3.svg)](https://storage.googleapis.com/tensorflow-kokoro-build-badges/ubuntu-gpu-py3.html) | [PyPI](https://pypi.org/project/tf-nightly-gpu/)
+**Linux XLA**                 | [![Status](https://storage.googleapis.com/tensorflow-kokoro-build-badges/ubuntu-xla.svg)](https://storage.googleapis.com/tensorflow-kokoro-build-badges/ubuntu-xla.html)         | TBA
+**macOS**                     | [![Status](https://storage.googleapis.com/tensorflow-kokoro-build-badges/macos-py2-cc.svg)](https://storage.googleapis.com/tensorflow-kokoro-build-badges/macos-py2-cc.html)     | [PyPI](https://pypi.org/project/tf-nightly/)
+**Windows CPU**               | [![Status](https://storage.googleapis.com/tensorflow-kokoro-build-badges/windows-cpu.svg)](https://storage.googleapis.com/tensorflow-kokoro-build-badges/windows-cpu.html)       | [PyPI](https://pypi.org/project/tf-nightly/)
+**Windows GPU**               | [![Status](https://storage.googleapis.com/tensorflow-kokoro-build-badges/windows-gpu.svg)](https://storage.googleapis.com/tensorflow-kokoro-build-badges/windows-gpu.html)       | [PyPI](https://pypi.org/project/tf-nightly-gpu/)
+**Android**                   | [![Status](https://storage.googleapis.com/tensorflow-kokoro-build-badges/android.svg)](https://storage.googleapis.com/tensorflow-kokoro-build-badges/android.html)               | [Download](https://bintray.com/google/tensorflow/tensorflow/_latestVersion)
+**Raspberry Pi 0 and 1**      | [![Status](https://storage.googleapis.com/tensorflow-kokoro-build-badges/rpi01-py3.svg)](https://storage.googleapis.com/tensorflow-kokoro-build-badges/rpi01-py3.html)           | [Py3](https://storage.googleapis.com/tensorflow-nightly/tensorflow-1.10.0-cp34-none-linux_armv6l.whl)
+**Raspberry Pi 2 and 3**      | [![Status](https://storage.googleapis.com/tensorflow-kokoro-build-badges/rpi23-py3.svg)](https://storage.googleapis.com/tensorflow-kokoro-build-badges/rpi23-py3.html)           | [Py3](https://storage.googleapis.com/tensorflow-nightly/tensorflow-1.10.0-cp34-none-linux_armv7l.whl)
+
+## Resources
+
+*   [TensorFlow.org](https://www.tensorflow.org)
+*   [TensorFlow Tutorials](https://www.tensorflow.org/tutorials/)
+*   [TensorFlow Official Models](https://github.com/tensorflow/models/tree/master/official)
+*   [TensorFlow Examples](https://github.com/tensorflow/examples)
+*   [TensorFlow Codelabs](https://codelabs.developers.google.com/?cat=TensorFlow)
+*   [TensorFlow Blog](https://blog.tensorflow.org)
+*   [Learn ML with TensorFlow](https://www.tensorflow.org/resources/learn-ml)
+*   [TensorFlow Twitter](https://twitter.com/tensorflow)
+*   [TensorFlow YouTube](https://www.youtube.com/channel/UC0rqucBdTuFTjJiefW5t-IQ)
+*   [TensorFlow model optimization roadmap](https://www.tensorflow.org/model_optimization/guide/roadmap)
+*   [TensorFlow White Papers](https://www.tensorflow.org/about/bib)
+*   [TensorBoard Visualization Toolkit](https://github.com/tensorflow/tensorboard)
+*   [TensorFlow Code Search](https://cs.opensource.google/tensorflow/tensorflow)
+
+Learn more about the
+[TensorFlow Community](https://www.tensorflow.org/community) and how to
+[Contribute](https://www.tensorflow.org/community/contribute).
+
+## Courses
+
+* [Coursera](https://www.coursera.org/search?query=TensorFlow)
+* [Udacity](https://www.udacity.com/courses/all?search=TensorFlow)
+* [Edx](https://www.edx.org/search?q=TensorFlow)
+
+## License
+
+[Apache License 2.0](LICENSE)

README.wehub.md

@@ -0,0 +1,7 @@
+# WeHub 来源说明
+
+- 原始项目：`tensorflow/tensorflow`
+- 原始仓库：https://github.com/tensorflow/tensorflow
+- 导入方式：上游默认分支的最新快照
+- 原作者、版权和许可证信息以原始仓库及本仓库 LICENSE 为准
+- 本文件仅用于记录来源，不代表 WeHub 是原项目作者

SECURITY.md

@@ -0,0 +1,187 @@
+# Using TensorFlow Securely
+
+This document discusses the TensorFlow security model. It describes the security
+risks to consider when using models, checkpoints or input data for training or
+serving. We also provide guidelines on what constitutes a vulnerability in
+TensorFlow and how to report them.
+
+This document applies to other repositories in the TensorFlow organization,
+covering security practices for the entirety of the TensorFlow ecosystem.
+
+## TensorFlow models are programs
+
+TensorFlow
+[**models**](https://developers.google.com/machine-learning/glossary/#model) (to
+use a term commonly used by machine learning practitioners) are expressed as
+programs that TensorFlow executes. TensorFlow programs are encoded as
+computation
+[**graphs**](https://developers.google.com/machine-learning/glossary/#graph).
+Since models are practically programs that TensorFlow executes, using untrusted
+models or graphs is equivalent to running untrusted code.
+
+If you need to run untrusted models, execute them inside a
+[**sandbox**](https://developers.google.com/code-sandboxing). Memory corruptions
+in TensorFlow ops can be recognized as security issues only if they are
+reachable and exploitable through production-grade, benign models.
+
+### Saved graphs and checkpoints
+
+When loading untrusted serialized computation graphs (in form of a `GraphDef`,
+`SavedModel`, or equivalent on-disk format), the set of computation primitives
+available to TensorFlow is powerful enough that you should assume that the
+TensorFlow process effectively executes arbitrary code.
+
+The risk of loading untrusted checkpoints depends on the code or graph that you
+are working with. When loading untrusted checkpoints, the values of the traced
+variables from your model are also going to be untrusted. That means that if
+your code interacts with the filesystem, network, etc. and uses checkpointed
+variables as part of those interactions (ex: using a string variable to build a
+filesystem path), a maliciously created checkpoint might be able to change the
+targets of those operations, which could result in arbitrary
+read/write/executions.
+
+### Running a TensorFlow server
+
+TensorFlow is a platform for distributed computing, and as such there is a
+TensorFlow server (`tf.train.Server`). The TensorFlow server is intended for
+internal communication only. It is not built for use in untrusted environments
+or networks.
+
+For performance reasons, the default TensorFlow server does not include any
+authorization protocol and sends messages unencrypted. It accepts connections
+from anywhere, and executes the graphs it is sent without performing any checks.
+Therefore, if you run a `tf.train.Server` in your network, anybody with access
+to the network can execute arbitrary code with the privileges of the user
+running the `tf.train.Server`.
+
+## Untrusted inputs during training and prediction
+
+TensorFlow supports a wide range of input data formats. For example it can
+process images, audio, videos, and text. There are several modules specialized
+in taking those formats, modifying them, and/or converting them to intermediate
+formats that can be processed by TensorFlow.
+
+These modifications and conversions are handled by a variety of libraries that
+have different security properties and provide different levels of confidence
+when dealing with untrusted data. Based on the security history of these
+libraries we consider that it is safe to work with untrusted inputs for PNG,
+BMP, GIF, WAV, RAW, RAW\_PADDED, CSV and PROTO formats. All other input formats,
+including tensorflow-io should be sandboxed if used to process untrusted data.
+
+For example, if an attacker were to upload a malicious video file, they could
+potentially exploit a vulnerability in the TensorFlow code that handles videos,
+which could allow them to execute arbitrary code on the system running
+TensorFlow.
+
+It is important to keep TensorFlow up to date with the latest security patches
+and follow the sandboxing guideline above to protect against these types of
+vulnerabilities.
+
+## Security properties of execution modes
+
+TensorFlow has several execution modes, with Eager-mode being the default in v2.
+Eager mode lets users write imperative-style statements that can be easily
+inspected and debugged and it is intended to be used during the development
+phase.
+
+As part of the differences that make Eager mode easier to debug, the [shape
+inference
+functions](https://www.tensorflow.org/guide/create_op#define_the_op_interface)
+are skipped, and any checks implemented inside the shape inference code are not
+executed.
+
+The security impact of skipping those checks should be low, since the attack
+scenario would require a malicious user to be able to control the model which as
+stated above is already equivalent to code execution. In any case, the
+recommendation is not to serve models using Eager mode since it also has
+performance limitations.
+
+## Multi-Tenant environments
+
+It is possible to run multiple TensorFlow models in parallel. For example,
+`ModelServer` collates all computation graphs exposed to it (from multiple
+`SavedModel`) and executes them in parallel on available executors. Running
+TensorFlow in a multitenant design mixes the risks described above with the
+inherent ones from multitenant configurations. The primary areas of concern are
+tenant isolation, resource allocation, model sharing and hardware attacks.
+
+### Tenant isolation
+
+Since any tenants or users providing models, graphs or checkpoints can execute
+code in context of the TensorFlow service, it is important to design isolation
+mechanisms that prevent unwanted access to the data from other tenants.
+
+Network isolation between different models is also important not only to prevent
+unauthorized access to data or models, but also to prevent malicious users or
+tenants sending graphs to execute under another tenant’s identity.
+
+The isolation mechanisms are the responsibility of the users to design and
+implement, and therefore security issues deriving from their absence are not
+considered a vulnerability in TensorFlow.
+
+### Resource allocation
+
+A denial of service caused by one model could bring down the entire server, but
+we don't consider this as a vulnerability, given that models can exhaust
+resources in many different ways and solutions exist to prevent this from
+happening (e.g., rate limits, ACLs, monitors to restart broken servers).
+
+### Model sharing
+
+If the multitenant design allows sharing models, make sure that tenants and
+users are aware of the security risks detailed here and that they are going to
+be practically running code provided by other users. Currently there are no good
+ways to detect malicious models/graphs/checkpoints, so the recommended way to
+mitigate the risk in this scenario is to sandbox the model execution.
+
+### Hardware attacks
+
+Physical GPUs or TPUs can also be the target of attacks. [Published
+research](https://scholar.google.com/scholar?q=gpu+side+channel) shows that it
+might be possible to use side channel attacks on the GPU to leak data from other
+running models or processes in the same system. GPUs can also have
+implementation bugs that might allow attackers to leave malicious code running
+and leak or tamper with applications from other users. Please report
+vulnerabilities to the vendor of the affected hardware accelerator.
+
+## Reporting vulnerabilities
+
+### Vulnerabilities in TensorFlow
+
+This document covers different use cases for TensorFlow together with comments
+whether these uses were recommended or considered safe, or where we recommend
+some form of isolation when dealing with untrusted data. As a result, this
+document also outlines what issues we consider as TensorFlow security
+vulnerabilities.
+
+We recognize issues as vulnerabilities only when they occur in scenarios that we
+outline as safe; issues that have a security impact only when TensorFlow is used
+in a discouraged way (e.g. running untrusted models or checkpoints, data parsing
+outside of the safe formats, etc.) are not treated as vulnerabilities.
+
+### Reporting process
+
+Please use [Google Bug Hunters reporting form](https://g.co/vulnz) to report
+security vulnerabilities. Please include the following information along with
+your report:
+
+  - A descriptive title
+  - Your name and affiliation (if any).
+  - A description of the technical details of the vulnerabilities.
+  - A minimal example of the vulnerability. It is very important to let us know
+    how we can reproduce your findings. For memory corruption triggerable in
+    TensorFlow models, please demonstrate an exploit against one of Alphabet's
+    models in <https://tfhub.dev/>
+  - An explanation of who can exploit this vulnerability, and what they gain
+    when doing so. Write an attack scenario that demonstrates how your issue
+    violates the use cases and security assumptions defined in the threat model.
+    This will help us evaluate your report quickly, especially if the issue is
+    complex.
+  - Whether this vulnerability is public or known to third parties. If it is,
+    please provide details.
+
+We will try to fix the problems as soon as possible. Vulnerabilities will, in
+general, be batched to be fixed at the same time as a quarterly release. We
+credit reporters for identifying security issues, although we keep your name
+confidential if you request it. Please see Google Bug Hunters program website
+for more info.

WORKSPACE

@@ -0,0 +1,187 @@
+# buildifier: disable=load-on-top
+
+workspace(name = "org_tensorflow")
+
+# buildifier: disable=load-on-top
+
+load("//third_party:repo.bzl", "tf_http_archive", "tf_mirror_urls")
+
+tf_http_archive(
+    name = "rules_shell",
+    sha256 = "bc61ef94facc78e20a645726f64756e5e285a045037c7a61f65af2941f4c25e1",
+    strip_prefix = "rules_shell-0.4.1",
+    urls = tf_mirror_urls(
+        "https://github.com/bazelbuild/rules_shell/releases/download/v0.4.1/rules_shell-v0.4.1.tar.gz",
+    ),
+)
+
+# Initialize the TensorFlow repository and all dependencies.
+#
+# The cascade of load() statements and tf_workspace?() calls works around the
+# restriction that load() statements need to be at the top of .bzl files.
+# E.g. we can not retrieve a new repository with http_archive and then load()
+# a macro from that repository in the same file.
+load("@//tensorflow:workspace3.bzl", "tf_workspace3")
+
+tf_workspace3()
+
+load("@bazel_features//:deps.bzl", "bazel_features_deps")
+
+bazel_features_deps()
+
+load("@rules_shell//shell:repositories.bzl", "rules_shell_dependencies", "rules_shell_toolchains")
+
+rules_shell_dependencies()
+
+rules_shell_toolchains()
+
+# Initialize hermetic C++
+load(
+    "@rules_ml_toolchain//cc/deps:cc_toolchain_deps.bzl",
+    "cc_toolchain_deps",
+)
+
+cc_toolchain_deps()
+
+register_toolchains("@rules_ml_toolchain//cc:linux_x86_64_linux_x86_64")
+
+register_toolchains("@rules_ml_toolchain//cc:linux_x86_64_linux_x86_64_cuda")
+
+register_toolchains("@rules_ml_toolchain//cc:linux_aarch64_linux_aarch64")
+
+register_toolchains("@rules_ml_toolchain//cc:linux_aarch64_linux_aarch64_cuda")
+
+# Initialize hermetic Python
+load("@xla//third_party/py:python_init_rules.bzl", "python_init_rules")
+
+python_init_rules()
+
+load("@xla//third_party/py:python_init_repositories.bzl", "python_init_repositories")
+
+python_init_repositories(
+    default_python_version = "system",
+    local_wheel_dist_folder = "dist",
+    local_wheel_inclusion_list = [
+        "tensorflow*",
+        "tf_nightly*",
+    ],
+    local_wheel_workspaces = ["//:WORKSPACE"],
+    requirements = {
+        "3.10": "//:requirements_lock_3_10.txt",
+        "3.11": "//:requirements_lock_3_11.txt",
+        "3.12": "//:requirements_lock_3_12.txt",
+        "3.13": "//:requirements_lock_3_13.txt",
+        "3.14": "//:requirements_lock_3_14.txt",
+    },
+)
+
+load("@xla//third_party/py:python_init_toolchains.bzl", "python_init_toolchains")
+
+python_init_toolchains()
+
+load("@xla//third_party/py:python_init_pip.bzl", "python_init_pip")
+
+python_init_pip()
+
+load("@pypi//:requirements.bzl", "install_deps")
+
+install_deps()
+# End hermetic Python initialization
+
+load("@//tensorflow:workspace2.bzl", "tf_workspace2")
+
+tf_workspace2()
+
+load("@//tensorflow:workspace1.bzl", "tf_workspace1")
+
+tf_workspace1()
+
+load("@//tensorflow:workspace0.bzl", "tf_workspace0")
+
+tf_workspace0()
+
+load(
+    "@xla//third_party/py:python_wheel.bzl",
+    "nvidia_wheel_versions_repository",
+    "python_wheel_version_suffix_repository",
+)
+
+nvidia_wheel_versions_repository(
+    name = "nvidia_wheel_versions",
+    versions_source = "//ci/official/requirements_updater:nvidia-requirements.txt",
+)
+
+python_wheel_version_suffix_repository(name = "tf_wheel_version_suffix")
+
+load(
+    "@rules_ml_toolchain//gpu/cuda:cuda_json_init_repository.bzl",
+    "cuda_json_init_repository",
+)
+
+cuda_json_init_repository()
+
+load(
+    "@cuda_redist_json//:distributions.bzl",
+    "CUDA_REDISTRIBUTIONS",
+    "CUDNN_REDISTRIBUTIONS",
+)
+load(
+    "@rules_ml_toolchain//gpu/cuda:cuda_redist_init_repositories.bzl",
+    "cuda_redist_init_repositories",
+    "cudnn_redist_init_repository",
+)
+load(
+    "@rules_ml_toolchain//gpu/cuda:cuda_redist_versions.bzl",
+    "REDIST_VERSIONS_TO_BUILD_TEMPLATES",
+)
+load("@xla//third_party/cccl:workspace.bzl", "CCCL_2_8_5_DIST_DICT", "CCCL_GITHUB_VERSIONS_TO_BUILD_TEMPLATES")
+
+cuda_redist_init_repositories(
+    cuda_redistributions = CUDA_REDISTRIBUTIONS | CCCL_2_8_5_DIST_DICT,
+    redist_versions_to_build_templates = REDIST_VERSIONS_TO_BUILD_TEMPLATES | CCCL_GITHUB_VERSIONS_TO_BUILD_TEMPLATES,
+)
+
+cudnn_redist_init_repository(
+    cudnn_redistributions = CUDNN_REDISTRIBUTIONS,
+)
+
+load(
+    "@rules_ml_toolchain//gpu/cuda:cuda_configure.bzl",
+    "cuda_configure",
+)
+
+cuda_configure(name = "local_config_cuda")
+
+load(
+    "@rules_ml_toolchain//gpu/nccl:nccl_redist_init_repository.bzl",
+    "nccl_redist_init_repository",
+)
+
+nccl_redist_init_repository(patches = ["//third_party/nccl:nccl_wheel.patch"])
+
+load(
+    "@rules_ml_toolchain//gpu/nccl:nccl_configure.bzl",
+    "nccl_configure",
+)
+
+nccl_configure(name = "local_config_nccl")
+
+load(
+    "@rules_ml_toolchain//gpu/nvshmem:nvshmem_json_init_repository.bzl",
+    "nvshmem_json_init_repository",
+)
+
+nvshmem_json_init_repository()
+
+load(
+    "@nvshmem_redist_json//:distributions.bzl",
+    "NVSHMEM_REDISTRIBUTIONS",
+)
+load(
+    "@rules_ml_toolchain//gpu/nvshmem:nvshmem_redist_init_repository.bzl",
+    "nvshmem_redist_init_repository",
+)
+
+nvshmem_redist_init_repository(
+    nvshmem_redistributions = NVSHMEM_REDISTRIBUTIONS,
+)

arm_compiler.BUILD

@@ -0,0 +1,75 @@
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "gcc",
+    srcs = glob(["bin/*-gcc"]),
+)
+
+filegroup(
+    name = "ar",
+    srcs = glob(["bin/*-ar"]),
+)
+
+filegroup(
+    name = "ld",
+    srcs = glob(["bin/*-ld"]),
+)
+
+filegroup(
+    name = "nm",
+    srcs = glob(["bin/*-nm"]),
+)
+
+filegroup(
+    name = "objcopy",
+    srcs = glob(["bin/*-objcopy"]),
+)
+
+filegroup(
+    name = "objdump",
+    srcs = glob(["bin/*-objdump"]),
+)
+
+filegroup(
+    name = "strip",
+    srcs = glob(["bin/*-strip"]),
+)
+
+filegroup(
+    name = "as",
+    srcs = glob(["bin/*-as"]),
+)
+
+filegroup(
+    name = "compiler_pieces",
+    srcs = glob([
+        "arm-rpi-linux-gnueabihf/**",
+        "libexec/**",
+        "lib/gcc/arm-rpi-linux-gnueabihf/**",
+        "include/**",
+    ]),
+)
+
+filegroup(
+    name = "aarch64_compiler_pieces",
+    srcs = glob([
+        "aarch64-none-linux-gnu/**",
+        "libexec/**",
+        "lib/gcc/aarch64-none-linux-gnu/**",
+        "include/**",
+    ]),
+)
+
+filegroup(
+    name = "compiler_components",
+    srcs = [
+        ":ar",
+        ":as",
+        ":gcc",
+        ":ld",
+        ":nm",
+        ":objcopy",
+        ":objdump",
+        ":strip",
+    ],
+)

ci/README.md

@@ -0,0 +1,17 @@
+# TensorFlow continuous integration
+
+> **Warning** This folder is still under construction. It is part of an ongoing
+> effort to improve the structure of CI and build related files within the
+> TensorFlow repo. This warning will be removed when the contents of this
+> directory are stable and appropriate documentation around its usage is in
+> place.
+
+Maintainer: TensorFlow DevInfra
+
+********************************************************************************
+
+The CI folder contains the configuration files and scripts used to build, test,
+and deploy TensorFlow. This folder is typically used by continuous integration
+(CI) tools to build and test TensorFlow whenever there is a change to the
+code. This folder is broken into subfolders that represent the level of support
+and ownership of the files contained within.

ci/devinfra/README.md

@@ -0,0 +1,17 @@
+# DevInfra CI Directory
+
+> **Warning** This folder is still under construction. It is part of an ongoing
+> effort to improve the structure of CI and build related files within the
+> TensorFlow repo. This warning will be removed when the contents of this
+> directory are stable and appropriate documentation around its usage is in
+> place.
+
+Maintainer: TensorFlow DevInfra
+
+Issue Reporting: File an issue against this repo and tag
+[@devinfra](https://github.com/orgs/tensorflow/teams/devinfra)
+
+********************************************************************************
+
+A directory for build and CI related scripts and jobs managed by the TensorFlow
+DevInfra team but not part of the official build, test, or release process.

ci/devinfra/docker/windows/Dockerfile

@@ -0,0 +1,189 @@
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+# NOTE: This Dockerfile is no longer in use.
+# It is kept just in case, but it's recommended to use the 2022 version,
+# and that is what internal CI uses as well.
+
+# This Dockerfile creates an image that has:
+# - the correct MTU setting for networking from inside the container to work.
+# - Visual Studio 2022 Build Tools
+# - MSVC 14.39
+# - LLVM/Clang 18.1.4
+# - MSYS2 + curl, git, patch, vim, unzip, zip
+# - Python 3.12.3
+# - Bazelisk 1.19.0
+# - JDK 21 (Azul Zulu)
+
+FROM mcr.microsoft.com/windows/servercore:ltsc2019
+
+SHELL ["powershell.exe", "-ExecutionPolicy", "Bypass", "-Command", \
+       "$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue';$VerbosePreference = 'Continue';"]
+
+# This should only be necessary when running on A GCP VM, on a default
+# network, which has the MTU of 1460,
+# due to 40 bytes being reserved for GCP's internal usage.
+# Note, an invalid sub-interface name will lead to an obscure error, e.g.:
+# "The filename, directory name, or volume label syntax is incorrect."
+# In such cases, check that the name of the sub-interface is valid:
+# `netsh interface show interface`
+RUN netsh interface ipv4 set subinterface \"vEthernet (Ethernet)\" mtu=1460 store=persistent
+
+RUN md C:\TEMP
+RUN md C:\TMP
+
+# Install 7-Zip.
+RUN (New-Object Net.WebClient).DownloadFile('https://www.7-zip.org/a/7z2201-x64.msi', '7z.msi'); \
+    Start-Process msiexec.exe -ArgumentList \"/i 7z.msi /qn /norestart /log C:\\TEMP\\7z_install_log.txt\" -wait; \
+    Remove-Item .\7z.msi;
+
+# Download the Visual Studio 2022 Installer.
+RUN (New-Object Net.WebClient).DownloadFile('https://aka.ms/vs/17/release/vs_community.exe', 'C:\TEMP\vs_community.exe');
+# Install Visual Studio 2022 Build Tools + Compiler
+SHELL ["cmd", "/S", "/C"]
+# Packages, and component versions, can be found here:
+# https://learn.microsoft.com/en-us/visualstudio/install/workload-component-id-vs-build-tools
+RUN C:\TEMP\vs_community.exe \
+        --quiet --wait --norestart --nocache \
+        --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 \
+        --add Microsoft.VisualStudio.Workload.NativeDesktop \
+        --add Microsoft.VisualStudio.Component.VC.14.39.17.9.x86.64 \
+        --add Microsoft.VisualStudio.Component.Windows11SDK.22621 \
+        --add Microsoft.VisualStudio.Component.VC.ATL \
+ || IF "%ERRORLEVEL%"=="3010" EXIT 0
+
+SHELL ["powershell.exe", "-ExecutionPolicy", "Bypass", "-Command", \
+       "$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue'; $VerbosePreference = 'Continue';"]
+
+# Install Clang.
+RUN (New-Object Net.WebClient).DownloadFile( \
+         'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.4/LLVM-18.1.4-win64.exe', \
+         'LLVM.exe'); \
+    Start-Process -FilePath \"C:\Program Files\7-Zip\7z.exe\" -ArgumentList 'x LLVM.exe -oC:\tools\LLVM' -Wait; \
+    $env:PATH = [Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';C:\tools\LLVM\bin'; \
+    [Environment]::SetEnvironmentVariable('PATH', $env:PATH, 'Machine');
+
+# Install MSYS2, and add some extra tools.
+RUN (New-Object Net.WebClient).DownloadFile( \
+         'https://repo.msys2.org/distrib/x86_64/msys2-base-x86_64-20240113.tar.xz', \
+         'msys2.tar.xz'); \
+    Start-Process -FilePath \"C:\Program Files\7-Zip\7z.exe\" -ArgumentList 'x msys2.tar.xz -oC:\TEMP\msys2.tar' -Wait; \
+    Start-Process -FilePath \"C:\Program Files\7-Zip\7z.exe\" -ArgumentList 'x C:\TEMP\msys2.tar -oC:\tools' -Wait; \
+    $env:PATH = [Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';C:\tools\msys64;C:\tools\msys64\usr\bin\'; \
+    [Environment]::SetEnvironmentVariable('PATH', $env:PATH, 'Machine');
+
+# Disable signature checking on pacman because we cannot initialize the keyring.
+RUN Add-Content -Path C:\tools\msys64\etc\pacman.d\mirrorlist.mingw32 -Value 'SigLevel = Never'
+RUN Add-Content -Path C:\tools\msys64\etc\pacman.d\mirrorlist.mingw64 -Value 'SigLevel = Never'
+RUN Add-Content -Path C:\tools\msys64\etc\pacman.d\mirrorlist.msys -Value 'SigLevel = Never'
+
+# Install pacman packages.
+RUN C:\tools\msys64\usr\bin\bash.exe -lc \
+  'pacman --noconfirm -Syy curl git patch vim unzip zip'
+
+# Install Python as a general utility/tool.
+ENV PYTHON_VERSION 3.12.3
+
+RUN $url = ('https://www.python.org/ftp/python/{0}/python-{0}-amd64.exe' -f $env:PYTHON_VERSION); \
+	Write-Host ('Downloading {0} ...' -f $url); \
+	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; \
+	(New-Object Net.WebClient).DownloadFile($url, 'C:\tmp\pyinstall.exe'); \
+	\
+	Write-Host 'Installing...'; \
+        Start-Process -FilePath \"C:\tmp\pyinstall.exe\" -ArgumentList '/quiet InstallAllUsers=1 PrependPath=1 TargetDir=C:\Python312' -Wait; \
+	\
+	Write-Host 'Verifying install ...'; \
+	Write-Host '  python --version'; C:\python312\python.exe --version; \
+	\
+	Write-Host 'Verifying pip install ...'; \
+	C:\python312\python.exe -m pip --version; \
+	\
+	Write-Host 'Removing ...'; \
+	Remove-Item C:\tmp\pyinstall.exe -Force; \
+	\
+	Write-Host 'Complete.';
+
+# Install pip packages.
+RUN python -m pip install --ignore-installed --force-reinstall --upgrade \
+    setuptools packaging
+
+# Install JDK 21.
+RUN \
+  Add-Type -AssemblyName \"System.IO.Compression.FileSystem\"; \
+  $zulu_pkg = \"zulu21.34.19-ca-jdk21.0.3-win_x64.zip\"; \
+  $zulu_url = \"https://cdn.azul.com/zulu/bin/${zulu_pkg}\"; \
+  $zulu_zip = \"c:\\temp\\${zulu_pkg}\"; \
+  $zulu_extracted_path = \"c:\\temp\\\" + [IO.Path]::GetFileNameWithoutExtension($zulu_zip); \
+  $zulu_root = \"c:\\openjdk\"; \
+  (New-Object Net.WebClient).DownloadFile($zulu_url, $zulu_zip); \
+  [System.IO.Compression.ZipFile]::ExtractToDirectory($zulu_zip, \"c:\\temp\"); \
+  Move-Item $zulu_extracted_path -Destination $zulu_root; \
+  Remove-Item $zulu_zip; \
+  $env:PATH = [Environment]::GetEnvironmentVariable(\"PATH\", \"Machine\") + \";${zulu_root}\\bin\"; \
+  [Environment]::SetEnvironmentVariable(\"PATH\", $env:PATH, \"Machine\"); \
+  $env:JAVA_HOME = $zulu_root; \
+  [Environment]::SetEnvironmentVariable(\"JAVA_HOME\", $env:JAVA_HOME, \"Machine\")
+
+# Point to the LLVM installation.
+# The Bazel Windows guide claims it can find LLVM automatically,
+# but it likely only works if it's installed somewhere inside C:\Program Files.
+ENV BAZEL_LLVM "C:\tools\LLVM"
+
+# These variables may be useful, but so far haven't been. Keeping for posterity.
+# ENV CLANG_COMPILER_PATH "C:\tools\llvm\bin\clang.exe"
+# ENV CC "C:\tools\llvm\bin\clang.exe"
+# ENV BAZEL_COMPILER "C:\tools\llvm\bin\clang.exe"
+
+ENV BAZEL_SH "C:\tools\msys64\usr\bin\bash.exe"
+ENV BAZEL_VS "C:\Program Files\Microsoft Visual Studio\2022\BuildTools"
+ENV BAZEL_VC "C:\Program Files\Microsoft Visual Studio\2022\Community\VC"
+
+# Environment variables to work around MSYS issues.
+ENV MSYS_NO_PATHCONV 1
+ENV MSYS2_ARG_CONV_EXCL *
+
+# This should only be necessary if there are multiple, differently-versioned
+# MSVC compilers installed, and a particular one should be used.
+# To find exact versions available:
+# - Navigate to the relevant folder, e.g.
+#     C:\Program Files\Microsoft Visual Studio\2022
+# - Search for the `cl.exe` file: `gci -r -fi cl.exe`
+# - The version will be part of the found path, e.g.
+#     2022\Community\VC\Tools\MSVC\14.39.33519\bin\Hostx64\x64
+# ENV BAZEL_VC_FULL_VERSION 14.39.33519
+
+# Install Bazelisk.
+RUN md C:\tools\bazel
+RUN (New-Object Net.WebClient).DownloadFile( \
+         'https://github.com/bazelbuild/bazelisk/releases/download/v1.19.0/bazelisk-windows-amd64.exe', \
+         'C:\tools\bazel\bazel.exe'); \
+    $env:PATH = [Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';C:\tools\bazel'; \
+    [Environment]::SetEnvironmentVariable('PATH', $env:PATH, 'Machine');
+
+ENV CLOUDSDK_CORE_DISABLE_PROMPTS 1
+RUN (New-Object Net.WebClient).DownloadFile('https://dl.google.com/dl/cloudsdk/channels/rapid/google-cloud-sdk.zip', 'C:\Temp\google-cloud-sdk.zip'); \
+    Expand-Archive -Path 'C:\Temp\google-cloud-sdk.zip' -DestinationPath $env:ProgramFiles -Verbose:$false
+RUN & \"$env:ProgramFiles\\google-cloud-sdk\\install.bat\" --path-update false
+RUN $env:Path += \";$env:ProgramFiles\\google-cloud-sdk\\bin\"; \
+    [Environment]::SetEnvironmentVariable('Path', $env:Path, [EnvironmentVariableTarget]::Machine);
+# Re-enable prompts for interactive use.
+ENV CLOUDSDK_CORE_DISABLE_PROMPTS=""
+
+# MSYS attempts to use non-cmd versions, which aren't meant for Windows
+RUN Add-Content -Path C:\tools\msys64\.bashrc -Value 'alias gcloud=gcloud.cmd'
+RUN Add-Content -Path C:\tools\msys64\.bashrc -Value 'alias gsutil=gsutil.cmd'
+RUN Add-Content -Path C:\tools\msys64\.bashrc -Value 'alias bq=bq.cmd'
+
+SHELL ["cmd.exe", "/s", "/c"]

ci/devinfra/docker/windows2022/Dockerfile

@@ -0,0 +1,223 @@
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+# This Dockerfile creates an image that has:
+# - the correct MTU setting for networking from inside the container to work.
+# - Visual Studio 2022 Build Tools
+# - MSVC 14.39
+# - LLVM/Clang 18.1.4
+# - MSYS2 + curl, git, patch, vim, unzip, zip
+# - Python 3.9 - 3.14
+# - Bazelisk 1.22.1
+# - JDK 21 (Azul Zulu)
+
+FROM mcr.microsoft.com/windows/servercore:ltsc2022
+
+SHELL ["powershell.exe", "-ExecutionPolicy", "Bypass", "-Command", \
+       "$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue';$VerbosePreference = 'Continue';"]
+
+# Enable long paths
+RUN New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" -Name "LongPathsEnabled" -Value 1 -PropertyType DWORD -Force
+
+RUN md C:\TEMP
+RUN md C:\TMP
+ENV TMP "C:/TMP"
+ENV TEMP "C:/TEMP"
+
+# Install 7-Zip.
+RUN (New-Object Net.WebClient).DownloadFile('https://www.7-zip.org/a/7z2201-x64.msi', '7z.msi'); \
+    Start-Process msiexec.exe -ArgumentList \"/i 7z.msi /qn /norestart /log C:\\TEMP\\7z_install_log.txt\" -wait; \
+    Remove-Item .\7z.msi;
+
+# Download the Visual Studio 2022 Installer.
+RUN (New-Object Net.WebClient).DownloadFile('https://aka.ms/vs/17/release/vs_community.exe', 'C:\TEMP\vs_community.exe');
+# Install Visual Studio 2022 Build Tools + Compiler
+SHELL ["cmd", "/S", "/C"]
+# Packages, and component versions, can be found here:
+# https://learn.microsoft.com/en-us/visualstudio/install/workload-component-id-vs-build-tools
+RUN C:\TEMP\vs_community.exe \
+        --quiet --wait --norestart --nocache \
+        --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 \
+        --add Microsoft.VisualStudio.Workload.NativeDesktop \
+        --add Microsoft.VisualStudio.Component.VC.14.39.17.9.x86.64 \
+        --add Microsoft.VisualStudio.Component.Windows11SDK.22621 \
+ || IF "%ERRORLEVEL%"=="3010" EXIT 0
+
+SHELL ["powershell.exe", "-ExecutionPolicy", "Bypass", "-Command", \
+       "$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue'; $VerbosePreference = 'Continue';"]
+
+# Install Clang.
+RUN (New-Object Net.WebClient).DownloadFile( \
+         'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.4/LLVM-18.1.4-win64.exe', \
+         'LLVM.exe'); \
+    Start-Process -FilePath \"C:\Program Files\7-Zip\7z.exe\" -ArgumentList 'x LLVM.exe -oC:\tools\LLVM' -Wait; \
+    $env:PATH = [Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';C:\tools\LLVM\bin'; \
+    [Environment]::SetEnvironmentVariable('PATH', $env:PATH, 'Machine');
+
+# Install MSYS2.
+RUN (New-Object Net.WebClient).DownloadFile( \
+         'https://repo.msys2.org/distrib/x86_64/msys2-base-x86_64-20240727.tar.xz', \
+         'msys2.tar.xz'); \
+    Start-Process -FilePath \"C:\Program Files\7-Zip\7z.exe\" -ArgumentList 'x msys2.tar.xz -oC:\TEMP\msys2.tar' -Wait; \
+    Start-Process -FilePath \"C:\Program Files\7-Zip\7z.exe\" -ArgumentList 'x C:\TEMP\msys2.tar -oC:\tools' -Wait; \
+    $env:PATH = [Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';C:\tools\msys64;C:\tools\msys64\usr\bin\'; \
+    [Environment]::SetEnvironmentVariable('PATH', $env:PATH, 'Machine');
+
+# Disable signature checking on pacman because we cannot initialize the keyring.
+RUN Add-Content -Path C:\tools\msys64\etc\pacman.d\mirrorlist.mingw32 -Value 'SigLevel = Never'
+RUN Add-Content -Path C:\tools\msys64\etc\pacman.d\mirrorlist.mingw64 -Value 'SigLevel = Never'
+RUN Add-Content -Path C:\tools\msys64\etc\pacman.d\mirrorlist.msys -Value 'SigLevel = Never'
+
+# Install pacman packages.
+RUN C:\tools\msys64\usr\bin\bash.exe -lc \
+  'pacman --noconfirm -Syy curl git patch vim unzip zip'
+
+# Install multiple Pythons, but only add one of them to PATH.
+RUN function Install-Python { \
+        param( \
+            [string]$version, \
+            [int]$prependPath \
+        ) \
+        $url = ('https://www.python.org/ftp/python/{0}/python-{0}-amd64.exe' -f $version); \
+        Write-Host ('Downloading {0}...' -f $url); \
+        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; \
+        (New-Object Net.WebClient).DownloadFile($url, 'C:\tmp\pyinstall.exe'); \
+        \
+        # Without the patch version \
+        $truncatedVersion = $($version -replace '\.\d+$', ''); \
+        $installDir = 'C:\Python' + $truncatedVersion; \
+        Write-Host ('Installing into {0} (PrependPath: {1})...' -f $installDir, $($prependPath -eq 1)); \
+        $argumentList = ('/quiet InstallAllUsers=1 PrependPath={0} TargetDir={1}' -f $prependPath, $installDir); \
+        Start-Process -FilePath 'C:\tmp\pyinstall.exe' -ArgumentList $argumentList -Wait; \
+        \
+        Write-Host 'Verifying install...'; \
+        Write-Host \"  python --version $version\"; & $installDir\python.exe --version; \
+        \
+        Write-Host 'Verifying pip install...'; \
+        & $installDir\python.exe -m pip --version; \
+        \
+        Write-Host 'Updating pip...'; \
+        & $installDir\python.exe -m pip install --upgrade pip; \
+        \
+        Write-Host 'Installing/updating packages...'; \
+        & $installDir\python.exe -m pip install --upgrade setuptools packaging; \
+        \
+        Write-Host 'Removing installation binary...'; \
+        Remove-Item C:\tmp\pyinstall.exe -Force; \
+    }; \
+    Write-Host 'Installing multiple Python versions...'; \
+    $versions = @( \
+        @{ version = '3.9.13'; prependPath = 0 }, \
+        @{ version = '3.10.11'; prependPath = 0 }, \
+        @{ version = '3.11.9'; prependPath = 0 }, \
+        @{ version = '3.12.8'; prependPath = 0 }, \
+        @{ version = '3.13.1'; prependPath = 0 } \
+        @{ version = '3.14.3'; prependPath = 1 } \
+    ); \
+    foreach ($v in $versions) { \
+        Install-Python -version $v.version -prependPath $v.prependPath; \
+    }; \
+    Write-Host 'Python installations complete.';
+
+# Add a python3 symlink for the Python in PATH.
+# It's not feasible to add one for each version, as on Windows,
+# Python uses PATH and the binary's (symlink's) location, to launch itself.
+RUN C:\tools\msys64\usr\bin\bash.exe -lc 'ln -s /c/Python3.13/python.exe /usr/bin/python3';
+
+# Install JDK 21.
+RUN \
+  Add-Type -AssemblyName \"System.IO.Compression.FileSystem\"; \
+  $zulu_pkg = \"zulu21.34.19-ca-jdk21.0.3-win_x64.zip\"; \
+  $zulu_url = \"https://cdn.azul.com/zulu/bin/${zulu_pkg}\"; \
+  $zulu_zip = \"c:\\temp\\${zulu_pkg}\"; \
+  $zulu_extracted_path = \"c:\\temp\\\" + [IO.Path]::GetFileNameWithoutExtension($zulu_zip); \
+  $zulu_root = \"c:\\openjdk\"; \
+  (New-Object Net.WebClient).DownloadFile($zulu_url, $zulu_zip); \
+  [System.IO.Compression.ZipFile]::ExtractToDirectory($zulu_zip, \"c:\\temp\"); \
+  Move-Item $zulu_extracted_path -Destination $zulu_root; \
+  Remove-Item $zulu_zip; \
+  $env:PATH = [Environment]::GetEnvironmentVariable(\"PATH\", \"Machine\") + \";${zulu_root}\\bin\"; \
+  [Environment]::SetEnvironmentVariable(\"PATH\", $env:PATH, \"Machine\"); \
+  $env:JAVA_HOME = $zulu_root; \
+  [Environment]::SetEnvironmentVariable(\"JAVA_HOME\", $env:JAVA_HOME, \"Machine\")
+
+# Point to the LLVM installation.
+# The Bazel Windows guide claims it can find LLVM automatically,
+# but it likely only works if it's installed somewhere inside C:\Program Files.
+ENV BAZEL_LLVM "C:\tools\LLVM"
+
+# These variables may be useful, but so far haven't been. Keeping for posterity.
+# ENV CLANG_COMPILER_PATH "C:\tools\llvm\bin\clang.exe"
+# ENV CC "C:\tools\llvm\bin\clang.exe"
+# ENV BAZEL_COMPILER "C:\tools\llvm\bin\clang.exe"
+
+ENV BAZEL_SH "C:\tools\msys64\usr\bin\bash.exe"
+ENV BAZEL_VS "C:\Program Files\Microsoft Visual Studio\2022\BuildTools"
+ENV BAZEL_VC "C:\Program Files\Microsoft Visual Studio\2022\Community\VC"
+
+# Environment variables to prevent auto-conversion of Linux-like paths to Windows paths.
+# This is necessary as some paths end up invalid/mangled.
+ENV MSYS_NO_PATHCONV 1
+ENV MSYS2_ARG_CONV_EXCL *
+
+# This should only be necessary if there are multiple, differently-versioned
+# MSVC compilers installed, and a particular one should be used.
+# To find exact versions available:
+# - Navigate to the relevant folder, e.g.
+#     C:\Program Files\Microsoft Visual Studio\2022
+# - Search for the `cl.exe` file: `gci -r -fi cl.exe`
+# - The version will be part of the found path, e.g.
+#     2022\Community\VC\Tools\MSVC\14.39.33519\bin\Hostx64\x64
+# ENV BAZEL_VC_FULL_VERSION 14.39.33519
+
+# Install Bazelisk.
+RUN md C:\tools\bazel
+RUN (New-Object Net.WebClient).DownloadFile( \
+         'https://github.com/bazelbuild/bazelisk/releases/download/v1.22.1/bazelisk-windows-amd64.exe', \
+         'C:\tools\bazel\bazel.exe'); \
+    $env:PATH = [Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';C:\tools\bazel'; \
+    [Environment]::SetEnvironmentVariable('PATH', $env:PATH, 'Machine');
+
+# Install gcloud, and add it to PATH
+ENV CLOUDSDK_CORE_DISABLE_PROMPTS 1
+RUN (New-Object Net.WebClient).DownloadFile('https://dl.google.com/dl/cloudsdk/channels/rapid/google-cloud-sdk.zip', 'C:\Temp\google-cloud-sdk.zip'); \
+    Expand-Archive -Path 'C:\Temp\google-cloud-sdk.zip' -DestinationPath $env:ProgramFiles -Verbose:$false
+RUN & \"$env:ProgramFiles\\google-cloud-sdk\\install.bat\" --path-update false
+RUN $env:Path += \";$env:ProgramFiles\\google-cloud-sdk\\bin\"; \
+    [Environment]::SetEnvironmentVariable('Path', $env:Path, [EnvironmentVariableTarget]::Machine);
+# Re-enable prompts for interactive use.
+ENV CLOUDSDK_CORE_DISABLE_PROMPTS=""
+
+# MSYS attempts to use non-cmd versions, which aren't meant for Windows
+RUN Add-Content -Path C:\tools\msys64\.bashrc -Value 'alias gcloud=gcloud.cmd'
+RUN Add-Content -Path C:\tools\msys64\.bashrc -Value 'alias gsutil=gsutil.cmd'
+RUN Add-Content -Path C:\tools\msys64\.bashrc -Value 'alias bq=bq.cmd'
+
+# Symlink a directory, to have it pretend be the T:\ drive.
+# This drive letter is used by internal CI,
+# and part of it is mounted to the container during the container's creation.
+#
+# While the mount argument (`-v host_path:container_path`) still requires
+# `container_path` to be a legitimate C:\ path, in this case, 'C:\drive_t',
+# this symlink does allow for the convenience of passing unedited paths
+# to `docker exec` commands, e.g., 'T:\path', instead of 'C:\path',
+# without having to replace the drive letter with C:\ every time.
+# Such a workaround is not required on Linux, since it
+# can create arbitrary paths within the container, e.g., '/t'.
+# Note: This does not affect/work for `docker cp` commands.
+RUN New-Item -ItemType directory -Path C:\drive_t; \
+    New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices' -Name 'T:'  -Value '\??\C:\drive_t' -PropertyType String;
+
+CMD ["bash", "-i"]

ci/official/README.md

@@ -0,0 +1,175 @@
+# Official CI Directory
+
+Maintainer: TensorFlow and TensorFlow DevInfra
+
+Issue Reporting: File an issue against this repo and tag
+[@devinfra](https://github.com/orgs/tensorflow/teams/devinfra)
+
+********************************************************************************
+
+## TensorFlow's Official CI and Build/Test Scripts
+
+TensorFlow's official CI jobs run the scripts in this folder. Our internal CI
+system, Kokoro, schedules our CI jobs by combining a build script with a file
+from the `envs` directory that is filled with configuration options:
+
+-   Nightly jobs (Run nightly on the `nightly` branch)
+    -   Uses `wheel.sh`, `libtensorflow.sh`, `code_check_full.sh`
+-   Continuous jobs (Run on every GitHub commit)
+    -   Uses `pycpp.sh`
+-   Presubmit jobs (Run on every GitHub PR)
+    -   Uses `pycpp.sh`, `code_check_changed_files.sh`
+
+These "env" files match up with an environment matrix that roughly covers:
+
+-   Different Python versions
+-   Linux, MacOS, and Windows machines (these pool definitions are internal)
+-   x86 and arm64
+-   CPU-only, or with NVIDIA CUDA support (Linux only), or with TPUs
+
+## How to Test Your Changes to TensorFlow
+
+You may check how your changes will affect TensorFlow by:
+
+1. Creating a PR and observing the presubmit test results
+2. Running the CI scripts locally, as explained below
+3. **Google employees only**: Google employees can use an internal-only tool
+called "MLCI" that makes testing more convenient: it can execute any full CI job
+against a pending change. Search for "MLCI" internally to find it.
+
+You may invoke a CI script of your choice by following these instructions:
+
+```bash
+cd tensorflow-git-dir
+
+# Here is a single-line example of running a script on Linux to build the
+# GPU version of TensorFlow for Python 3.12, using the public TF bazel cache and
+# a local build cache:
+TFCI=py312,linux_x86_cuda,public_cache,disk_cache ci/official/wheel.sh
+
+# First, set your TFCI variable to choose the environment settings.
+#   TFCI is a comma-separated list of filenames from the envs directory, which
+#   are all settings for the scripts. TF's CI jobs are all made of a combination
+#   of these env files.
+#
+#   If you've clicked on a test result from our CI (via a dashboard or GitHub link),
+#   click to "Invocation Details" and find BUILD_CONFIG, which will contain a TFCI
+#   value in the "env_vars" list that you can choose to copy that environment.
+#      Ex. 1: TFCI=py311,linux_x86_cuda,nightly_upload  (nightly job)
+#      Ex. 2: TFCI=py39,linux_x86,rbe                   (continuous job)
+#   Non-Googlers should replace "nightly_upload" or "rbe" with
+#   "public_cache,disk_cache".
+#   Googlers should replace "nightly_upload" with "public_cache,disk_cache" or
+#   "rbe", if you have set up your system to use RBE (see further below).
+#
+# Here is how to choose your TFCI value:
+# 1. A Python version must come first, because other scripts reference it.
+#      Ex. py39  -- Python 3.9
+#      Ex. py310 -- Python 3.10
+#      Ex. py311 -- Python 3.11
+#      Ex. py312 -- Python 3.12
+# 2. Choose the platform, which corresponds to the version of TensorFlow to
+#    build. This should also match the system you're using--you cannot build
+#    the TF MacOS package from Linux.
+#      Ex. linux_x86        -- x86_64 Linux platform
+#      Ex. linux_x86_cuda   -- x86_64 Linux platform, with Nvidia CUDA support
+#      Ex. macos_arm64      -- arm64 MacOS platform
+# 3. Add modifiers. Some modifiers for local execution are:
+#      Ex. disk_cache -- Use a local cache
+#      Ex. public_cache -- Use TF's public cache (read-only)
+#      Ex. public_cache_push -- Use TF's public cache (read and write, Googlers only)
+#      Ex. rbe        -- Use RBE for faster builds (Googlers only; see below)
+#      Ex. no_docker  -- Disable docker on enabled platforms
+#    See full examples below for more details on these. Some other modifiers are:
+#      Ex. versions_upload -- for TF official release versions
+#      Ex. nightly_upload -- for TF nightly official builds; changes version numbers
+#      Ex. no_upload      -- Disable all uploads, usually for temporary CI issues
+
+# Recommended: use a local+remote cache.
+#
+#   Bazel will cache your builds in tensorflow/build_output/cache,
+#   and will also try using public build cache results to speed up
+#   your builds. This usually saves a lot of time, especially when
+#   re-running tests. However, note that:
+#
+#    - New environments like new CUDA versions, changes to manylinux,
+#      compilers, etc. can cause undefined behavior such as build failures
+#      or tests passing incorrectly.
+#    - Automatic LLVM updates are known to extend build time even with
+#      the cache; this is unavoidable.
+export TFCI=py311,linux_x86,public_cache,disk_cache
+
+# Recommended: Configure Docker. (Linux only)
+#
+#   TF uses hub.docker.com/r/tensorflow/build containers for CI,
+#   and scripts on Linux create a persistent container called "tf"
+#   which mounts your TensorFlow directory into the container.
+#
+#   Important: because the container is persistent, you cannot change TFCI
+#   variables in between script executions. To forcibly remove the
+#   container and start fresh, run "docker rm -f tf". Removing the container
+#   destroys some temporary bazel data and causes longer builds.
+#
+#   You will need the NVIDIA Container Toolkit for GPU testing:
+#   https://github.com/NVIDIA/nvidia-container-toolkit
+#
+#   Note: if you interrupt a bazel command on docker (ctrl-c), you
+#   will need to run `docker exec tf pkill bazel` to quit bazel.
+#
+#   Note: new files created from the container are owned by "root".
+#   You can run e.g. `docker exec tf chown -R $(id -u):$(id -g) build_output`
+#   to transfer ownership to your user.
+#
+# Docker is enabled by default on Linux. You may disable it if you prefer:
+# export TFCI=py311,linux_x86,no_docker
+
+# Advanced: Use Remote Build Execution (RBE) (internal developers only)
+#
+#   RBE dramatically speeds up builds and testing. It also gives you a
+#   public URL to share your build results with collaborators. However,
+#   it is only available to a limited set of internal TensorFlow developers.
+#
+#   RBE is incompatible with local caching, so you must remove
+#   disk_cache, public_cache, and public_cache_push from your $TFCI file.
+#
+# To use RBE, you must first run `gcloud auth application-default login`, then:
+export TFCI=py311,linux_x86,rbe
+
+# Finally: Run your script of choice.
+#   If you've clicked on a test result from our CI (via a dashboard or GitHub link),
+#   click to "Invocation Details" and find BUILD_CONFIG, which will contain a
+#   "build_file" item that indicates the script used.
+ci/official/wheel.sh
+
+# Advanced: Select specific build/test targets with "any.sh".
+# TF_ANY_TARGETS=":your/target" TF_ANY_MODE="test" ci/official/any.sh
+
+# Afterwards: Examine the results, which will include: The bazel cache,
+# generated artifacts like .whl files, and "script.log", from the script.
+# Note that files created under Docker will be owned by "root".
+ls build_output
+```
+
+## Contribution & Maintenance
+
+The TensorFlow team does not yet have guidelines in place for contributing to
+this directory. We are working on it. Please join a TF SIG Build meeting (see:
+bit.ly/tf-sig-build-notes) if you'd like to discuss the future of contributions.
+
+### Brief System Overview
+
+The top-level scripts and utility scripts should be fairly well-documented. Here
+is a brief explanation of how they tie together:
+
+1.  `envs/*` are lists of variables made with bash syntax. A user must set a
+    `TFCI` env param pointing to a list of `env` files.
+2.  `utilities/setup.sh`, initialized by all top-level scripts, reads and sets
+    values from those `TFCI` paths.
+    -   `set -a` / `set -o allexport` exports the variables from `env` files so
+        all scripts can use them.
+    -   `utilities/setup_docker.sh` creates a container called `tf` with all
+        `TFCI_` variables shared to it.
+3.  Top-level scripts (`wheel.sh`, etc.) reference `env` variables and call
+    `utilities/` scripts.
+    -   The `tfrun` function makes a command run correctly in Docker if Docker
+        is enabled.

ci/official/any.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+# any.sh has two run modes.
+#
+# 1. RUN, TEST, OR BUILD BAZEL TARGET(S) WITHIN A TFCI ENVIRONMENT
+#    To use:
+#       export TFCI=ci/official/envs/env_goes_here
+#       export TF_ANY_TARGETS="quoted list of targets, like on the command line"
+#       export TF_ANY_MODE="test" or "build" or "run" (default: "test")
+#       ./any.sh
+#
+# 2. RUN ANY OTHER SCRIPT AND ENV WITH NO SIDE EFFECTS (NO UPLOADS)
+#    To use:
+#       export TFCI=ci/official/envs/env_goes_here
+#       export TF_ANY_SCRIPT=ci/official/wheel.sh
+#       ./any.sh
+#
+# 3. DO THE SAME WITH A LOCAL CACHE OR RBE:
+#       export TF_ANY_EXTRA_ENV=ci/official/envs/public_cache,ci/official/envs/disk_cache
+#       ...
+#       ./any.sh
+#     or
+#       export TF_ANY_EXTRA_ENV=ci/official/envs/local_rbe
+#       ./any.sh
+#       ...
+set -exo pipefail
+cd "$(dirname "$0")/../../"  # tensorflow/
+# Any request that includes "nightly_upload" should just use the
+# local multi-cache (public read-only cache + disk cache) instead.
+export TFCI="$(echo $TFCI | sed 's/,nightly_upload/,public_cache,disk_cache/')"
+if [[ -n "${TF_ANY_EXTRA_ENV:-}" ]]; then
+  export TFCI="$TFCI,$TF_ANY_EXTRA_ENV"
+fi
+if [[ -n "${TF_ANY_SCRIPT:-}" ]]; then
+  "$TF_ANY_SCRIPT"
+elif [[ -n "${TF_ANY_TARGETS:-}" ]]; then
+  source "${BASH_SOURCE%/*}/utilities/setup.sh"
+
+  # Extract hermetic CUDA UMD flags
+  HERMETIC_CUDA_UMD_FLAGS=""
+  if [[ "$TFCI_BAZEL_HERMETIC_CUDA_UMD_ENABLE" == 1 ]]; then
+    HERMETIC_CUDA_UMD_FLAGS="--@local_config_cuda//cuda:override_include_cuda_libs=true --config=hermetic_cuda_umd"
+  fi
+
+  tfrun bazel "${TF_ANY_MODE:-test}" $TFCI_BAZEL_COMMON_ARGS $HERMETIC_CUDA_UMD_FLAGS $TF_ANY_TARGETS
+else
+  echo 'Looks like $TF_ANY_TARGETS are $TF_ANY_SCRIPT are both empty. That is an error.'
+  exit 1
+fi

ci/official/bisect.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+# Run any CI script and env configuration to bisect a failing target in some
+# build configuration. You must set the following variables to control this
+# script:
+#
+#   TF_BISECT_GOOD: Last known good commit (e.g. commit from the last passing job)
+#   TF_BISECT_BAD: First bad commit (e.g. commit from the first failing job)
+#   TF_BISECT_SCRIPT: The build script path relative to the TF root dir, e.g.
+#     ci/official/wheel.sh
+#   TFCI: The env config path, relative to the TF root dir, e.g.
+#     ci/official/envs/an_env_config
+#
+# Note that you can combine bisect.sh with any.sh to bisect a single test:
+#
+#   export TFCI=...
+#   export TF_BISECT_SCRIPT=ci/official/any.sh
+#   export TF_BISECT_GOOD=a_good_commit_sha
+#   export TF_BISECT_BAD=a_failing_commit_sha
+#   export TF_ANY_TARGETS="quoted list of targets, like on the command line"
+#   export TF_ANY_MODE=test
+set -exo pipefail
+cd "$(dirname "$0")/../../"  # tensorflow/
+export TFCI="$(echo $TFCI | sed 's/,nightly_upload/,public_cache,disk_cache/')"
+git bisect start "$TF_BISECT_BAD" "$TF_BISECT_GOOD"
+git bisect run $TF_BISECT_SCRIPT

ci/official/code_check_changed_files.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+source "${BASH_SOURCE%/*}/utilities/setup.sh"
+
+tfrun bats ./ci/official/utilities/code_check_changed_files.bats --timing --output "$TFCI_OUTPUT_DIR"

ci/official/code_check_full.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+source "${BASH_SOURCE%/*}/utilities/setup.sh"
+
+tfrun bats ./ci/official/utilities/code_check_full.bats --timing --output "$TFCI_OUTPUT_DIR"

ci/official/containers/ml_build/Dockerfile

@@ -0,0 +1,125 @@
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+
+################################################################################
+ARG BASE_IMAGE=ubuntu:22.04@sha256:445586e41c1de7dfda82d2637f5ff688deea9eb5f5812f8c145afacc35b9f0db
+FROM $BASE_IMAGE AS devel
+# See https://docs.docker.com/reference/dockerfile/#understand-how-arg-and-from-interact
+# on why we cannot reference BASE_IMAGE again unless we declare it again.
+################################################################################
+
+# Install devtoolset build dependencies
+COPY setup.sources.sh /setup.sources.sh
+COPY setup.packages.sh /setup.packages.sh
+COPY builder.packages.txt /builder.packages.txt
+
+RUN /setup.sources.sh && /setup.packages.sh /builder.packages.txt
+
+# Setup Python
+COPY setup.python.sh /setup.python.sh
+COPY builder.requirements.txt /builder.requirements.txt
+RUN /setup.python.sh python3.10 /builder.requirements.txt
+RUN /setup.python.sh python3.11 /builder.requirements.txt
+RUN /setup.python.sh python3.13 /builder.requirements.txt
+RUN /setup.python.sh python3.13-nogil /builder.requirements.txt
+RUN /setup.python.sh python3.14 /builder.requirements.txt
+RUN /setup.python.sh python3.14-nogil /builder.requirements.txt
+
+# Since we are using python3.12 as the default python version, we need to
+# install python3.12 last for now.
+# TODO(b/376338367): switch to pyenv.
+RUN /setup.python.sh python3.12 /builder.requirements.txt
+
+ARG INSTALL_NVIDIA_PACKAGES=false
+ARG NVIDIA_PACKAGES_FILE=cuda12.1_cudnn9.1.packages.txt
+COPY ${NVIDIA_PACKAGES_FILE} /nvidia.packages.txt
+COPY setup.sources.cudnn.sh /setup.sources.cudnn.sh
+
+ARG INSTALL_CMAKE_TOOLCHAIN=false
+ARG CMAKE_TOOLCHAIN_PACKAGES_FILE=cmake_toolchain.packages.txt
+COPY ${CMAKE_TOOLCHAIN_PACKAGES_FILE} /cmake_toolchain.packages.txt
+COPY setup.toolchain.cmake.sh /setup.toolchain.cmake.sh
+
+RUN if [ "${INSTALL_NVIDIA_PACKAGES}" = "true" ]; then \
+      echo "Installing Nvidia packages"; \
+      /setup.sources.cudnn.sh && /setup.packages.sh /nvidia.packages.txt; \
+    else \
+      echo "Nvidia packages will not be installed"; \
+    fi
+
+RUN if [ "${INSTALL_CMAKE_TOOLCHAIN}" = "true" ]; then \
+      echo "Installing CMake toolchain"; \
+      /setup.toolchain.cmake.sh && /setup.packages.sh /cmake_toolchain.packages.txt; \
+    else \
+      echo "CMake toolchain will not be installed"; \
+    fi
+
+# Setup links for TensorFlow to compile.
+# Referenced in devel.usertools/*.bazelrc.
+# Set python3.12 as the default python version.
+# TF does not support python3.13.
+RUN ln -sf /usr/bin/python3.12 /usr/bin/python3
+RUN ln -sf /usr/bin/python3.12 /usr/bin/python
+RUN ln -sf /usr/lib/python3.12 /usr/lib/tf_python
+
+# Link the compat driver to the location if available.
+RUN if [ -e "/usr/local/cuda/compat/libcuda.so.1" ]; then ln -s /usr/local/cuda/compat/libcuda.so.1 /usr/lib/x86_64-linux-gnu/libcuda.so.1; fi
+
+# Install various tools.
+# - bats: bash unit testing framework
+# - bazelisk: always use the correct bazel version
+# - buildifier: clean bazel build deps
+# - buildozer: clean bazel build deps
+# - gcloud SDK: communicate with Google Cloud Platform (GCP) for RBE, CI
+# - patchelf: Utility tool to modify existing ELF executables and libraries
+RUN git clone --branch v1.13.0 https://github.com/bats-core/bats-core.git && bats-core/install.sh /usr/local && rm -rf bats-core
+RUN wget https://github.com/bazelbuild/bazelisk/releases/download/v1.27.0/bazelisk-linux-amd64 -O /usr/local/bin/bazel && \
+    echo "e1508323f347ad1465a887bc5d2bfb91cffc232d11e8e997b623227c6b32fb76  /usr/local/bin/bazel" | sha256sum --check && \
+    chmod +x /usr/local/bin/bazel
+RUN wget https://github.com/bazelbuild/buildtools/releases/download/v8.2.1/buildifier-linux-amd64 -O /usr/local/bin/buildifier && \
+    echo "6ceb7b0ab7cf66fceccc56a027d21d9cc557a7f34af37d2101edb56b92fcfa1a  /usr/local/bin/buildifier" | sha256sum --check && \
+    chmod +x /usr/local/bin/buildifier
+RUN wget https://github.com/bazelbuild/buildtools/releases/download/v8.2.1/buildozer-linux-amd64 -O /usr/local/bin/buildozer && \
+    echo "04454a6a89c64c603027cc3371eb1c36e48727e04558e077c20ec37c9c2f831a  /usr/local/bin/buildozer" | sha256sum --check && \
+    chmod +x /usr/local/bin/buildozer
+
+RUN wget https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-483.0.0-linux-x86_64.tar.gz && \
+    echo "dd3ebdbd13bffa1997232ab5a68af7797594079b062fd41474c666b84165cc35  google-cloud-cli-483.0.0-linux-x86_64.tar.gz" | sha256sum --check && \
+    tar zxf google-cloud-cli-483.0.0-linux-x86_64.tar.gz && \
+    rm google-cloud-cli-483.0.0-linux-x86_64.tar.gz && \
+    google-cloud-sdk/install.sh --quiet && \
+    ln -s /google-cloud-sdk/bin/gcloud /usr/bin/gcloud
+ENV PATH="$PATH:/google-cloud-sdk/bin/:/usr/local/cuda/bin/"
+
+# Download and install gh CLI v2.49.0 from GitHub.
+RUN wget https://github.com/cli/cli/releases/download/v2.49.0/gh_2.49.0_linux_amd64.tar.gz && \
+    echo "3f7ef10a8ae6164220db20cf6d4fb96528c61d614f0803ccf39b1cabb6ae7263  gh_2.49.0_linux_amd64.tar.gz" | sha256sum --check && \
+    tar zxf gh_2.49.0_linux_amd64.tar.gz && \
+    mv gh_2.49.0_linux_amd64/bin/gh /usr/local/bin/gh && \
+    rm -rf gh_2.49.0_linux_amd64*
+
+# Download and install patchelf v0.18.0 from GitHub. The default Ubuntu focal
+# packages only provide the "0.10-2build1" version. We use patchelf to manipulate
+# certain shared libraries during the wheel building process (https://github.com/tensorflow/tensorflow/blob/master/tensorflow/tools/pip_package/build_pip_package.sh#L255-L262).
+# When we use Patchelf versions <0.12, those shared libraries end up with a
+# corrupted PT_NOTE program header. This was fixed in v0.12, see https://github.com/NixOS/patchelf/commit/43a33482b501b0f5ee9da312aabfca3806570cc9.
+RUN wget https://github.com/NixOS/patchelf/releases/download/0.18.0/patchelf-0.18.0-x86_64.tar.gz && \
+    echo "ce84f2447fb7a8679e58bc54a20dc2b01b37b5802e12c57eece772a6f14bf3f0  patchelf-0.18.0-x86_64.tar.gz" | sha256sum --check && \
+    tar -zxvf patchelf-0.18.0-x86_64.tar.gz -C /usr && \
+    rm -rf patchelf-0.18.0-x86_64.tar.gz
+
+# Don't use the bazel cache when a new docker image is created.
+RUN echo build --action_env=DOCKER_CACHEBUSTER=$(date +%s%N)$RANDOM >> /etc/bazel.bazelrc
+RUN echo build --host_action_env=DOCKER_HOST_CACHEBUSTER=$(date +%s%N)$RANDOM >> /etc/bazel.bazelrc

ci/official/containers/ml_build/README.md

@@ -0,0 +1,8 @@
+WIP ML Build Docker container for ML repositories (Tensorflow, JAX and XLA).
+
+This container branches off from
+/tensorflow/tools/tf_sig_build_dockerfiles/. However, since
+hermetic CUDA and hermetic Python is now available for Tensorflow, a lot of the
+requirements installed on the original container can be removed to reduce the
+footprint of the container and make it more reusable across different ML
+repositories.

ci/official/containers/ml_build/builder.devtoolset/build_devtoolset.sh

@@ -0,0 +1,198 @@
+#!/bin/bash -eu
+# Copyright 2016 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+#
+# Builds a devtoolset cross-compiler targeting manylinux 2010 (glibc 2.12 /
+# libstdc++ 4.4) or manylinux2014 (glibc 2.17 / libstdc++ 4.8).
+
+VERSION="$1"
+TARGET="$2"
+
+case "${VERSION}" in
+devtoolset-7)
+  LIBSTDCXX_VERSION="6.0.24"
+  LIBSTDCXX_ABI="gcc4-compatible"
+  ;;
+devtoolset-9)
+  LIBSTDCXX_VERSION="6.0.28"
+  LIBSTDCXX_ABI="new"
+  ;;
+*)
+  echo "Usage: $0 {devtoolset-7|devtoolset-9} <target-directory>"
+  echo "Use 'devtoolset-7' to build a manylinux2010 compatible toolchain or 'devtoolset-9' to build a manylinux2014 compatible toolchain"
+  exit 1
+  ;;
+esac
+
+mkdir -p "${TARGET}"
+
+# Download glibc's shared and development libraries based on the value of the
+# `VERSION` parameter.
+# Note: 'Templatizing' this and the other conditional branches would require
+# defining several variables (version, os, path) making it difficult to maintain
+# and extend for future modifications.
+case "${VERSION}" in
+devtoolset-7)
+  # Download binary glibc 2.12 shared library release.
+  wget "http://old-releases.ubuntu.com/ubuntu/pool/main/e/eglibc/libc6_2.12.1-0ubuntu6_amd64.deb" && \
+      unar "libc6_2.12.1-0ubuntu6_amd64.deb" && \
+      tar -C "${TARGET}" -xvzf "libc6_2.12.1-0ubuntu6_amd64/data.tar.gz" && \
+      rm -rf "libc6_2.12.1-0ubuntu6_amd64.deb" "libc6_2.12.1-0ubuntu6_amd64"
+  # Download binary glibc 2.12 development library release.
+  wget "http://old-releases.ubuntu.com/ubuntu/pool/main/e/eglibc/libc6-dev_2.12.1-0ubuntu6_amd64.deb" && \
+      unar "libc6-dev_2.12.1-0ubuntu6_amd64.deb" && \
+      tar -C "${TARGET}" -xvzf "libc6-dev_2.12.1-0ubuntu6_amd64/data.tar.gz" && \
+      rm -rf "libc6-dev_2.12.1-0ubuntu6_amd64.deb" "libc6-dev_2.12.1-0ubuntu6_amd64"
+  ;;
+devtoolset-9)
+  # Download binary glibc 2.17 shared library release.
+  wget "http://old-releases.ubuntu.com/ubuntu/pool/main/e/eglibc/libc6_2.17-0ubuntu5.1_amd64.deb" && \
+      unar "libc6_2.17-0ubuntu5.1_amd64.deb" && \
+      tar -C "${TARGET}" -xvzf "libc6_2.17-0ubuntu5.1_amd64/data.tar.gz" && \
+      rm -rf "libc6_2.17-0ubuntu5.1_amd64.deb" "libc6_2.17-0ubuntu5.1_amd64"
+  # Download binary glibc 2.17 development library release.
+  wget "http://old-releases.ubuntu.com/ubuntu/pool/main/e/eglibc/libc6-dev_2.17-0ubuntu5.1_amd64.deb" && \
+      unar "libc6-dev_2.17-0ubuntu5.1_amd64.deb" && \
+      tar -C "${TARGET}" -xvzf "libc6-dev_2.17-0ubuntu5.1_amd64/data.tar.gz" && \
+      rm -rf "libc6-dev_2.17-0ubuntu5.1_amd64.deb" "libc6-dev_2.17-0ubuntu5.1_amd64"
+  ;;
+esac
+
+# Put the current kernel headers from ubuntu in place.
+ln -s "/usr/include/linux" "/${TARGET}/usr/include/linux"
+ln -s "/usr/include/asm-generic" "/${TARGET}/usr/include/asm-generic"
+ln -s "/usr/include/x86_64-linux-gnu/asm" "/${TARGET}/usr/include/asm"
+
+# Symlinks in the binary distribution are set up for installation in /usr, we
+# need to fix up all the links to stay within /${TARGET}.
+/fixlinks.sh "/${TARGET}"
+
+# Patch to allow non-glibc 2.12 compatible builds to work.
+sed -i '54i#define TCP_USER_TIMEOUT 18' "/${TARGET}/usr/include/netinet/tcp.h"
+
+# Download specific version of libstdc++ shared library based on the value of
+# the `VERSION` parameter
+case "${VERSION}" in
+devtoolset-7)
+  # Download binary libstdc++ 4.4 release we are going to link against.
+  # We only need the shared library, as we're going to develop against the
+  # libstdc++ provided by devtoolset.
+  wget "http://old-releases.ubuntu.com/ubuntu/pool/main/g/gcc-4.4/libstdc++6_4.4.3-4ubuntu5_amd64.deb" && \
+      unar "libstdc++6_4.4.3-4ubuntu5_amd64.deb" && \
+      tar -C "/${TARGET}" -xvzf "libstdc++6_4.4.3-4ubuntu5_amd64/data.tar.gz" "./usr/lib/libstdc++.so.6.0.13" && \
+      rm -rf "libstdc++6_4.4.3-4ubuntu5_amd64.deb" "libstdc++6_4.4.3-4ubuntu5_amd64"
+  ;;
+devtoolset-9)
+  # Download binary libstdc++ 4.8 shared library release
+  wget "http://old-releases.ubuntu.com/ubuntu/pool/main/g/gcc-4.8/libstdc++6_4.8.1-10ubuntu8_amd64.deb" && \
+      unar "libstdc++6_4.8.1-10ubuntu8_amd64.deb" && \
+      tar -C "/${TARGET}" -xvzf "libstdc++6_4.8.1-10ubuntu8_amd64/data.tar.gz" "./usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.18"  && \
+      rm -rf "libstdc++6_4.8.1-10ubuntu8_amd64.deb" "libstdc++6_4.8.1-10ubuntu8_amd64"
+  ;;
+esac
+
+mkdir -p "${TARGET}-src"
+cd "${TARGET}-src"
+
+# Build a devtoolset cross-compiler based on our glibc 2.12/glibc 2.17 sysroot setup.
+case "${VERSION}" in
+devtoolset-7)
+  wget "http://vault.centos.org/centos/6/sclo/Source/rh/devtoolset-7/devtoolset-7-gcc-7.3.1-5.15.el6.src.rpm"
+  rpm2cpio "devtoolset-7-gcc-7.3.1-5.15.el6.src.rpm" |cpio -idmv
+  tar -xvjf "gcc-7.3.1-20180303.tar.bz2" --strip 1
+  ;;
+devtoolset-9)
+  wget "https://vault.centos.org/centos/7/sclo/Source/rh/devtoolset-9-gcc-9.3.1-2.2.el7.src.rpm"
+  rpm2cpio "devtoolset-9-gcc-9.3.1-2.2.el7.src.rpm" |cpio -idmv
+  tar -xvf "gcc-9.3.1-20200408.tar.xz" --strip 1
+  ;;
+esac
+
+# Apply the devtoolset patches to gcc.
+/rpm-patch.sh "gcc.spec"
+
+./contrib/download_prerequisites
+
+mkdir -p "${TARGET}-build"
+cd "${TARGET}-build"
+
+"${TARGET}-src/configure" \
+      --prefix=/"${TARGET}/usr" \
+      --with-sysroot="/${TARGET}" \
+      --disable-bootstrap \
+      --disable-libmpx \
+      --disable-libsanitizer \
+      --disable-libunwind-exceptions \
+      --disable-libunwind-exceptions \
+      --disable-lto \
+      --disable-multilib \
+      --enable-__cxa_atexit \
+      --enable-gnu-indirect-function \
+      --enable-gnu-unique-object \
+      --enable-initfini-array \
+      --enable-languages="c,c++" \
+      --enable-linker-build-id \
+      --enable-plugin \
+      --enable-shared \
+      --enable-threads=posix \
+      --with-default-libstdcxx-abi=${LIBSTDCXX_ABI} \
+      --with-gcc-major-version-only \
+      --with-linker-hash-style="gnu" \
+      --with-tune="generic" \
+      && \
+    make -j 42 && \
+    make install
+
+
+# Create the devtoolset libstdc++ linkerscript that links dynamically against
+# the system libstdc++ 4.4 and provides all other symbols statically.
+case "${VERSION}" in
+devtoolset-7)
+mv "/${TARGET}/usr/lib/libstdc++.so.${LIBSTDCXX_VERSION}" \
+   "/${TARGET}/usr/lib/libstdc++.so.${LIBSTDCXX_VERSION}.backup"
+echo -e "OUTPUT_FORMAT(elf64-x86-64)\nINPUT ( libstdc++.so.6.0.13 -lstdc++_nonshared44 )" \
+   > "/${TARGET}/usr/lib/libstdc++.so.${LIBSTDCXX_VERSION}"
+cp "./x86_64-pc-linux-gnu/libstdc++-v3/src/.libs/libstdc++_nonshared44.a" \
+   "/${TARGET}/usr/lib"
+  ;;
+devtoolset-9)
+# Note that the installation path for libstdc++ here is /${TARGET}/usr/lib64/
+mv "/${TARGET}/usr/lib64/libstdc++.so.${LIBSTDCXX_VERSION}" \
+   "/${TARGET}/usr/lib64/libstdc++.so.${LIBSTDCXX_VERSION}.backup"
+echo -e "OUTPUT_FORMAT(elf64-x86-64)\nINPUT ( libstdc++.so.6.0.18 -lstdc++_nonshared44 )" \
+   > "/${TARGET}/usr/lib64/libstdc++.so.${LIBSTDCXX_VERSION}"
+cp "./x86_64-pc-linux-gnu/libstdc++-v3/src/.libs/libstdc++_nonshared44.a" \
+   "/${TARGET}/usr/lib64"
+;;
+esac
+
+# Link in architecture specific includes from the system; note that we cannot
+# link in the whole x86_64-linux-gnu folder, as otherwise we're overlaying
+# system gcc paths that we do not want to find.
+# TODO(klimek): Automate linking in all non-gcc / non-kernel include
+# directories.
+mkdir -p "/${TARGET}/usr/include/x86_64-linux-gnu"
+PYTHON_VERSIONS=("python3.10" "python3.11" "python3.12")
+for v in "${PYTHON_VERSIONS[@]}"; do
+  ln -s "/usr/local/include/${v}" "/${TARGET}/usr/include/x86_64-linux-gnu/${v}"
+done
+
+# Patch glibc to be compatable with modern clang
+case "${VERSION}" in
+devtoolset-9)
+  cd /
+  patch -p0 < /glibc2.17-inline.patch
+;;
+esac

ci/official/containers/ml_build/builder.devtoolset/fixlinks.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# Copyright 2016 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+#
+# Re-direct all links in $1 that point to /lib... to point to $1/lib... instead.
+
+BASE="$1"
+find "${BASE}" -type l | \
+  while read l ; do
+    if [[ "$(readlink "$l")" == /lib* ]]; then
+      ORIG="$(readlink "$l")";
+      rm "$l";
+      ln -s "${BASE}${ORIG}" "$l"
+    fi
+  done
+

ci/official/containers/ml_build/builder.devtoolset/glibc2.17-inline.patch

@@ -0,0 +1,11 @@
+--- /dt9/usr/include/x86_64-linux-gnu/sys/cdefs.h       2013-09-30 13:58:17.000000000 +0000
++++ /dt9/usr/include/x86_64-linux-gnu/sys/cdefs.new.h   2022-11-04 17:17:31.727061220 +0000
+@@ -320,7 +320,7 @@
+
+ /* GCC 4.3 and above with -std=c99 or -std=gnu99 implements ISO C99
+    inline semantics, unless -fgnu89-inline is used.  */
+-#if (!defined __cplusplus || __GNUC_PREREQ (4,3)) && defined __GNUC__
++#if (!defined __cplusplus || __GNUC_PREREQ (4,3) || defined __clang__) && defined __GNUC__
+ # if defined __GNUC_STDC_INLINE__ || defined __cplusplus
+ #  define __extern_inline extern __inline __attribute__ ((__gnu_inline__))
+ #  define __extern_always_inline \

ci/official/containers/ml_build/builder.devtoolset/rpm-patch.sh

@@ -0,0 +1,28 @@
+#!/bin/bash -eu
+# Copyright 2016 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+#
+# Given an RPM spec file $1, apply its patches.
+
+SPEC="$1"
+grep '%patch' "${SPEC}" |while read cmd ; do
+  N=$(echo "${cmd}" |sed 's,%patch\([0-9]\+\).*,\1,')
+  file=$(grep "Patch$N:" "${SPEC}" |sed 's,.*: ,,')
+  parg=$(echo "${cmd}" |sed 's,.*\(-p[0-9]\).*,\1,')
+  if [[ ! "${file}" =~ doxygen && "${cmd}" != \#* ]]; then
+    echo "patch ${parg} -s < ${file}"
+    patch ${parg} -s < "${file}"
+  fi
+done

ci/official/containers/ml_build/builder.packages.txt

@@ -0,0 +1,18 @@
+# Other build-related tools
+apt-transport-https
+autoconf
+automake
+build-essential
+ca-certificates
+curl
+git
+parallel
+sudo
+swig
+unzip
+zip
+openjdk-25-jdk
+vim
+wget
+jq
+file

ci/official/containers/ml_build/builder.requirements.txt

@@ -0,0 +1,20 @@
+# For wheel verification, and uploading
+auditwheel ~= 6.1.0
+twine ~= 6.1.0
+id
+urllib3
+requests
+
+# For XLA
+pyyaml
+
+# For JAX
+build ~= 1.2.2
+# uv is faster than pip for installing Python packages.
+uv ~= 0.5.30
+
+# For running wheel verification script
+immutabledict ~= 4.2.1
+
+# For MLIR's stubgen.py script
+typing-extensions

ci/official/containers/ml_build/cmake_toolchain.packages.txt

@@ -0,0 +1,8 @@
+cmake
+ninja-build
+ccache
+clang-18
+lld-18
+libclang-rt-18-dev
+libstdc++-13-dev
+lsb-release

ci/official/containers/ml_build/cuda12.1_cudnn9.1.packages.txt

@@ -0,0 +1,21 @@
+# All required CUDA packages
+cuda-compat-12-1
+cuda-command-line-tools-12-1
+cuda-cudart-dev-12-1
+cuda-nvcc-12-1
+cuda-cupti-12-1
+cuda-nvprune-12-1
+cuda-libraries-12-1
+cuda-libraries-dev-12-1
+cuda-nvml-dev-12-1
+libcufft-12-1
+libcurand-12-1
+libcusolver-dev-12-1
+libcusparse-dev-12-1
+libcublas-12-1
+libcublas-dev-12-1
+libnccl-dev=2.18.3-1+cuda12.1
+libnccl2=2.18.3-1+cuda12.1
+# CuDNN: https://docs.nvidia.com/deeplearning/sdk/cudnn-install/index.html#ubuntu-network-installation
+libcudnn9-dev-cuda-12=9.1.1.17-1
+libcudnn9-cuda-12=9.1.1.17-1

ci/official/containers/ml_build/cuda12.1_cudnn9.8.packages.txt

@@ -0,0 +1,21 @@
+# All required CUDA packages
+cuda-compat-12-1
+cuda-command-line-tools-12-1
+cuda-cudart-dev-12-1
+cuda-nvcc-12-1
+cuda-cupti-12-1
+cuda-nvprune-12-1
+cuda-libraries-12-1
+cuda-libraries-dev-12-1
+cuda-nvml-dev-12-1
+libcufft-12-1
+libcurand-12-1
+libcusolver-dev-12-1
+libcusparse-dev-12-1
+libcublas-12-1
+libcublas-dev-12-1
+libnccl-dev=2.18.3-1+cuda12.1
+libnccl2=2.18.3-1+cuda12.1
+# CuDNN: https://docs.nvidia.com/deeplearning/sdk/cudnn-install/index.html#ubuntu-network-installation
+libcudnn9-dev-cuda-12=9.8.0.87-1
+libcudnn9-cuda-12=9.8.0.87-1

ci/official/containers/ml_build/cuda12.3_cudnn9.1.packages.txt

@@ -0,0 +1,21 @@
+# All required CUDA packages
+cuda-compat-12-3
+cuda-command-line-tools-12-3
+cuda-cudart-dev-12-3
+cuda-nvcc-12-3
+cuda-cupti-12-3
+cuda-nvprune-12-3
+cuda-libraries-12-3
+cuda-libraries-dev-12-3
+cuda-nvml-dev-12-3
+libcufft-12-3
+libcurand-12-3
+libcusolver-dev-12-3
+libcusparse-dev-12-3
+libcublas-12-3
+libcublas-dev-12-3
+libnccl-dev=2.19.3-1+cuda12.3
+libnccl2=2.19.3-1+cuda12.3
+# CuDNN: https://docs.nvidia.com/deeplearning/sdk/cudnn-install/index.html#ubuntu-network-installation
+libcudnn9-dev-cuda-12=9.1.1.17-1
+libcudnn9-cuda-12=9.1.1.17-1

ci/official/containers/ml_build/cuda12.8_cudnn9.8.packages.txt

@@ -0,0 +1,21 @@
+# All required CUDA packages
+cuda-compat-12-8
+cuda-command-line-tools-12-8
+cuda-cudart-dev-12-8
+cuda-nvcc-12-8
+cuda-cupti-12-8
+cuda-nvprune-12-8
+cuda-libraries-12-8
+cuda-libraries-dev-12-8
+cuda-nvml-dev-12-8
+libcufft-12-8
+libcurand-12-8
+libcusolver-dev-12-8
+libcusparse-dev-12-8
+libcublas-12-8
+libcublas-dev-12-8
+libnccl-dev=2.25.1-1+cuda12.8
+libnccl2=2.25.1-1+cuda12.8
+# CuDNN: https://docs.nvidia.com/deeplearning/sdk/cudnn-install/index.html#ubuntu-network-installation
+libcudnn9-dev-cuda-12=9.8.0.87-1
+libcudnn9-cuda-12=9.8.0.87-1

ci/official/containers/ml_build/cuda13.0_cudnn9.12.packages.txt

@@ -0,0 +1,23 @@
+# All required CUDA packages
+cuda-compat-13-0
+cuda-command-line-tools-13-0
+cuda-cudart-dev-13-0
+cuda-nvcc-13-0
+cuda-cupti-13-0
+cuda-nvprune-13-0
+cuda-libraries-13-0
+cuda-libraries-dev-13-0
+cuda-nvml-dev-13-0
+libcufft-13-0
+libcurand-13-0
+libcusolver-dev-13-0
+libcusparse-dev-13-0
+libcublas-13-0
+libcublas-dev-13-0
+libnccl-dev=2.27.7-1+cuda13.0
+libnccl2=2.27.7-1+cuda13.0
+# CuDNN: https://docs.nvidia.com/deeplearning/sdk/cudnn-install/index.html#ubuntu-network-installation
+libcudnn9-headers-cuda-13=9.12.0.46-1
+libcudnn9-static-cuda-13=9.12.0.46-1
+libcudnn9-dev-cuda-13=9.12.0.46-1
+libcudnn9-cuda-13=9.12.0.46-1

ci/official/containers/ml_build/cuda13.0_cudnn9.15.packages.txt

@@ -0,0 +1,23 @@
+# All required CUDA packages
+cuda-compat-13-0
+cuda-command-line-tools-13-0
+cuda-cudart-dev-13-0
+cuda-nvcc-13-0
+cuda-cupti-13-0
+cuda-nvprune-13-0
+cuda-libraries-13-0
+cuda-libraries-dev-13-0
+cuda-nvml-dev-13-0
+libcufft-13-0
+libcurand-13-0
+libcusolver-dev-13-0
+libcusparse-dev-13-0
+libcublas-13-0
+libcublas-dev-13-0
+libnccl-dev=2.27.7-1+cuda13.0
+libnccl2=2.27.7-1+cuda13.0
+# CuDNN: https://docs.nvidia.com/deeplearning/sdk/cudnn-install/index.html#ubuntu-network-installation
+libcudnn9-headers-cuda-13=9.15.1.9-1
+libcudnn9-static-cuda-13=9.15.1.9-1
+libcudnn9-dev-cuda-13=9.15.1.9-1
+libcudnn9-cuda-13=9.15.1.9-1

ci/official/containers/ml_build/cuda13.2_cudnn9.15.packages.txt

@@ -0,0 +1,23 @@
+# All required CUDA packages
+cuda-compat-13-2
+cuda-command-line-tools-13-2
+cuda-cudart-dev-13-2
+cuda-nvcc-13-2
+cuda-cupti-13-2
+cuda-nvprune-13-2
+cuda-libraries-13-2
+cuda-libraries-dev-13-2
+cuda-nvml-dev-13-2
+libcufft-13-2
+libcurand-13-2
+libcusolver-dev-13-2
+libcusparse-dev-13-2
+libcublas-13-2
+libcublas-dev-13-2
+libnccl-dev=2.29.7-1+cuda13.2
+libnccl2=2.29.7-1+cuda13.2
+# CuDNN: https://docs.nvidia.com/deeplearning/sdk/cudnn-install/index.html#ubuntu-network-installation
+libcudnn9-headers-cuda-13=9.15.1.9-1
+libcudnn9-static-cuda-13=9.15.1.9-1
+libcudnn9-dev-cuda-13=9.15.1.9-1
+libcudnn9-cuda-13=9.15.1.9-1

ci/official/containers/ml_build/rbe_nvidia.packages.txt

@@ -0,0 +1,7 @@
+# The RBE machine itself has older kernel mode driver, and it requires
+# nvidia driver to be installed.
+nvidia-driver-580-open
+# TODO(b/445248346): The Docker image shouldn't have cuda-compat installed.
+# However, hermetic CUDA forward-compatibility mode is still missing some
+# libraries.
+cuda-compat-13-0

ci/official/containers/ml_build/setup.packages.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+#
+# Copyright 2022 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+#
+# setup.packages.sh: Given a list of Ubuntu packages, install them and clean up.
+# Usage: setup.packages.sh <package_list.txt>
+set -e
+
+# Prevent apt install tzinfo from asking our location (assumes UTC)
+export DEBIAN_FRONTEND=noninteractive
+
+# Update index for latest packages and upgrade base image packages.
+# Updating base image packages pulls in security fixes.
+apt-get update && apt-get upgrade -y
+# Remove commented lines and blank lines
+apt-get install -y --no-install-recommends $(sed -e '/^\s*#.*$/d' -e '/^\s*$/d' "$1" | sort -u)
+rm -rf /var/lib/apt/lists/*

ci/official/containers/ml_build/setup.python.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+#
+# Copyright 2022 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+#
+# setup.python.sh: Install a specific Python version and packages for it.
+# Usage: setup.python.sh <pyversion> <requirements.txt>
+set -xe
+
+source ~/.bashrc
+VERSION=$1
+REQUIREMENTS=$2
+
+# Install Python packages for this container's version
+if [[ ${VERSION} == "python3.13-nogil" || ${VERSION} == "python3.14-nogil" ]]; then
+  cat >pythons.txt <<EOF
+$VERSION
+EOF
+elif [[ ${VERSION} == "python3.14" || ${VERSION} == "python3.13" || ${VERSION} == "python3.12" ]]; then
+  cat >pythons.txt <<EOF
+$VERSION
+$VERSION-dev
+$VERSION-venv
+EOF
+else
+  cat >pythons.txt <<EOF
+$VERSION
+$VERSION-dev
+$VERSION-venv
+$VERSION-distutils
+EOF
+fi
+
+/setup.packages.sh pythons.txt
+
+# Python 3.10 include headers fix:
+# sysconfig.get_path('include') incorrectly points to /usr/local/include/python
+# map /usr/include/python3.10 to /usr/local/include/python3.10
+if [[ ! -f "/usr/local/include/$VERSION" ]]; then
+  ln -sf /usr/include/$VERSION /usr/local/include/$VERSION
+fi
+
+# Install pip
+wget --retry-connrefused --waitretry=1 --read-timeout=20 --timeout=15 --tries=5 https://bootstrap.pypa.io/get-pip.py
+/usr/bin/$VERSION get-pip.py
+/usr/bin/$VERSION -m pip install --no-cache-dir --upgrade pip
+/usr/bin/$VERSION -m pip install -U setuptools
+
+
+# For Python 3.13t, do not install twine as it does not have pre-built wheels
+# for this Python version and building it from source fails. We only need twine
+# to be present on the system Python which in this case is 3.12.
+# Same reason for Python 3.14.
+if [[ ${VERSION} == "python3.13-nogil" || ${VERSION} == "python3.14" || ${VERSION} == "python3.14-nogil" ]]; then
+  grep -v "twine" $REQUIREMENTS > requirements_without_twine.txt
+  REQUIREMENTS=requirements_without_twine.txt
+fi
+
+# Disable the cache dir to save image space, and install packages
+/usr/bin/$VERSION -m pip install --no-cache-dir -r $REQUIREMENTS -U

ci/official/containers/ml_build/setup.sources.cudnn.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+#
+# Copyright 2024 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+#
+# Sets up custom apt sources for our TF images.
+
+# Prevent apt install tzinfo from asking our location (assumes UTC)
+export DEBIAN_FRONTEND=noninteractive
+
+# Fetch the NVIDIA key.
+apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/3bf863cc.pub;
+
+# Set up sources for NVIDIA CUDNN.
+cat >/etc/apt/sources.list.d/nvidia.list <<SOURCES
+# NVIDIA
+deb https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/ /
+
+SOURCES

ci/official/containers/ml_build/setup.sources.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+#
+# Copyright 2024 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+#
+# Sets up custom apt sources for our TF images.
+
+# Prevent apt install tzinfo from asking our location (assumes UTC)
+export DEBIAN_FRONTEND=noninteractive
+
+# Set up shared custom sources
+apt-get update
+apt-get install -y gnupg ca-certificates software-properties-common
+add-apt-repository -y universe
+apt-get update
+
+# Deadsnakes: https://launchpad.net/~deadsnakes/+archive/ubuntu/ppa
+apt-key adv --keyserver keyserver.ubuntu.com --recv-keys F23C5A6CF475977595C89F51BA6932366A755776
+
+# LLVM/Clang: https://apt.llvm.org/
+apt-key adv --fetch-keys https://apt.llvm.org/llvm-snapshot.gpg.key
+
+# Set up custom sources
+cat >/etc/apt/sources.list.d/custom.list <<SOURCES
+# More Python versions: Deadsnakes
+deb http://ppa.launchpad.net/deadsnakes/ppa/ubuntu jammy main
+deb-src http://ppa.launchpad.net/deadsnakes/ppa/ubuntu jammy main
+
+# LLVM/Clang repository
+deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-18 main
+deb-src http://apt.llvm.org/jammy/ llvm-toolchain-jammy-18 main
+SOURCES

ci/official/containers/ml_build/setup.toolchain.cmake.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+#
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+#
+# Sets up custom apt sources for our TF images.
+
+# Prevent apt install tzinfo from asking our location (assumes UTC)
+export DEBIAN_FRONTEND=noninteractive
+
+# Install `software-properties-common` for `add-apt-repository`.
+apt-get update
+apt-get install -y software-properties-common
+
+# Add Ubuntu Toolchain PPA for newer GCC/libstdc++.
+add-apt-repository -y ppa:ubuntu-toolchain-r/test
+
+# Set up symlinks for Clang and LLD.
+ln -sf /usr/bin/clang-18 /usr/bin/clang
+ln -sf /usr/bin/clang++-18 /usr/bin/clang++
+ln -sf /usr/bin/lld-18 /usr/bin/lld

ci/official/debug_tfci.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+# This script dumps some information about the environment. It's most useful
+# for verifying changes to the TFCI scripts system, and most users won't need
+# to interact with it at all.
+source "${BASH_SOURCE%/*}/utilities/setup.sh"
+
+echo "==TFCI== env outside of tfrun:"
+env
+echo "==TFCI== env inside of tfrun:"
+tfrun env

ci/official/envs/bzlmod

@@ -0,0 +1,15 @@
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --config bzlmod"

ci/official/envs/ci_default

@@ -0,0 +1,81 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+# Note: this file gets sourced in utilities/setup.sh, which has "set -u"
+# (error on undefined variables). This ensures that (a) every TFCI variable
+# has an explicit default value, and (b) no script can accidentally use a
+# variable that doesn't exist. Please keep this list in alphabetical order.
+#
+# Find usage in scripts with e.g.:
+#   cd ci/official
+#   ls *.sh utilities/*.sh | xargs grep -H --color=always TFCI_ARG_HERE
+# You may also get an overview, e.g.:
+#   cd ci/official
+#   grep -o '^TFCI\w*' envs/ci_default | xargs -n 1 -I{} bash -c "echo; echo {}; grep -R -H --exclude-dir=envs --color=always '{}'"
+TFCI_ARTIFACT_FINAL_GAR_ARGS=
+TFCI_ARTIFACT_FINAL_GCS_ENABLE=
+TFCI_ARTIFACT_FINAL_GCS_SA_PATH=
+TFCI_ARTIFACT_FINAL_GCS_URI=
+TFCI_ARTIFACT_FINAL_PYPI_ARGS=
+TFCI_ARTIFACT_FINAL_PYPI_ENABLE=
+TFCI_ARTIFACT_LATEST_GCS_URI=
+TFCI_ARTIFACT_STAGING_GCS_ENABLE=
+TFCI_ARTIFACT_STAGING_GCS_URI=
+TFCI_BAZEL_BAZELRC_ARGS=
+TFCI_BAZEL_COMMON_ARGS=
+TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX=
+TFCI_BUILD_PIP_PACKAGE_BASE_ARGS=
+TFCI_BUILD_PIP_PACKAGE_WHEEL_NAME_ARG=
+# Mostly meant to be used for Windows.
+# For Windows, the same wheel is uploaded to both tensorflow_cpu, and tensorflow
+TFCI_BUILD_PIP_PACKAGE_ADDITIONAL_WHEEL_NAMES=
+TFCI_DOCKER_ARGS=
+TFCI_DOCKER_ENABLE=
+TFCI_DOCKER_IMAGE=
+TFCI_DOCKER_PULL_ENABLE=
+TFCI_DOCKER_REBUILD_ARGS=
+TFCI_DOCKER_REBUILD_ENABLE=
+TFCI_DOCKER_REBUILD_UPLOAD_ENABLE=
+TFCI_FIND_BIN=find
+TFCI_GIT_DIR=
+TFCI_INDEX_HTML_ENABLE=
+TFCI_INSTALLER_WHL_ENABLE=
+TFCI_INSTALLER_WHL_NIGHTLY_PROJECT_NAME=
+TFCI_INSTALLER_WHL_PROJECT_NAME=
+TFCI_INSTALLER_WHL_TAGS=
+TFCI_LIB_SUFFIX=
+TFCI_MACOS_BAZEL_TEST_DIR_ENABLE=
+TFCI_MACOS_BAZEL_TEST_DIR_PATH=
+TFCI_MACOS_CROSS_COMPILE_ENABLE=
+TFCI_MACOS_CROSS_COMPILE_SDK_DEST=
+TFCI_MACOS_CROSS_COMPILE_SDK_SOURCE=
+TFCI_MACOS_INSTALL_BAZELISK_ENABLE=
+TFCI_MACOS_INSTALL_BAZELISK_URL=
+TFCI_MACOS_PYENV_INSTALL_ENABLE=
+TFCI_MACOS_TWINE_INSTALL_ENABLE=
+TFCI_MACOS_UPGRADE_PYENV_ENABLE=
+TFCI_NIGHTLY_UPDATE_VERSION_ENABLE=
+TFCI_NVIDIA_SMI_ENABLE=
+TFCI_OUTPUT_DIR=
+TFCI_PYCPP_SWAP_TO_BUILD_ENABLE=
+TFCI_PYTHON_VERIFY_PIP_INSTALL_ARGS=
+TFCI_PYTHON_VERSION=
+TFCI_WHL_AUDIT_ENABLE=
+TFCI_WHL_AUDIT_PLAT=
+TFCI_WHL_BAZEL_TEST_ENABLE=
+TFCI_BAZEL_HERMETIC_CUDA_UMD_ENABLE=0
+TFCI_WHL_IMPORT_TEST_ENABLE=1
+TFCI_WHL_NUMPY_VERSION=2
+TFCI_WHL_SIZE_LIMIT_ENABLE=
+TFCI_WHL_SIZE_LIMIT=

ci/official/envs/disk_cache

@@ -0,0 +1,20 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+# Sourcing this enables local disk cache
+if [[ $(uname -s) == "Darwin" ]]; then
+  echo "Please note that using disk cache on macOS is not recommended because the"
+  echo "cache can end up being pretty big and make the build process inefficient."
+fi
+TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --disk_cache=$TFCI_OUTPUT_DIR/cache"

ci/official/envs/enable_pycpp_build

@@ -0,0 +1,20 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+#
+# Changes the behavior in pycpp.sh from "run all tests" to "verify that all
+# tests can compile." Used in some CI jobs (macOS and Linux Arm64) where test
+# execution is too expensive.
+TFCI_PYCPP_SWAP_TO_BUILD_ENABLE=1
+TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --build_tests_only"

ci/official/envs/linux_arm64

@@ -0,0 +1,32 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+TFCI_BAZEL_COMMON_ARGS="--repo_env=HERMETIC_PYTHON_VERSION=$TFCI_PYTHON_VERSION --repo_env=USE_PYWRAP_RULES=True --config release_arm64_linux"
+TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX=linux_arm64
+# Note: this is not set to "--cpu", because that changes the package name
+# to tensorflow_cpu. These ARM builds are supposed to have the name "tensorflow"
+# despite lacking Nvidia CUDA support.
+TFCI_BUILD_PIP_PACKAGE_WHEEL_NAME_ARG="--repo_env=WHEEL_NAME=tensorflow"
+TFCI_DOCKER_ENABLE=1
+TFCI_DOCKER_IMAGE=us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build-arm64:latest
+TFCI_DOCKER_PULL_ENABLE=1
+TFCI_DOCKER_REBUILD_ARGS="--target=tf ci/official/containers/ml_build_arm64"
+TFCI_INDEX_HTML_ENABLE=1
+TFCI_LIB_SUFFIX="-cpu-linux-arm64"
+TFCI_OUTPUT_DIR=build_output
+TFCI_WHL_AUDIT_ENABLE=1
+TFCI_WHL_AUDIT_PLAT=manylinux_2_27_aarch64
+TFCI_WHL_BAZEL_TEST_ENABLE=1
+TFCI_WHL_SIZE_LIMIT=300M
+TFCI_WHL_SIZE_LIMIT_ENABLE=1

ci/official/envs/linux_arm64_cross_compile

@@ -0,0 +1,17 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+source ci/official/envs/linux_arm64
+TFCI_BAZEL_COMMON_ARGS="--repo_env=HERMETIC_PYTHON_VERSION=$TFCI_PYTHON_VERSION --config cross_compile_linux_arm64 --repo_env=USE_PYWRAP_RULES=True"
+TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX=cross_compile_linux_arm64

ci/official/envs/linux_arm64_onednn

@@ -0,0 +1,16 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+source ci/official/envs/linux_arm64
+TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS  --test_env=TF_ENABLE_ONEDNN_OPTS=1"

ci/official/envs/linux_x86

@@ -0,0 +1,29 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+TFCI_BAZEL_COMMON_ARGS="--repo_env=HERMETIC_PYTHON_VERSION=$TFCI_PYTHON_VERSION --repo_env=USE_PYWRAP_RULES=True --config release_cpu_linux"
+TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX=linux_cpu
+TFCI_BUILD_PIP_PACKAGE_WHEEL_NAME_ARG="--repo_env=WHEEL_NAME=tensorflow_cpu"
+TFCI_DOCKER_ENABLE=1
+TFCI_DOCKER_IMAGE=us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build:latest
+TFCI_DOCKER_PULL_ENABLE=1
+TFCI_DOCKER_REBUILD_ARGS="--target=devel ci/official/containers/ml_build"
+TFCI_INDEX_HTML_ENABLE=1
+TFCI_LIB_SUFFIX="-cpu-linux-x86_64"
+TFCI_OUTPUT_DIR=build_output
+TFCI_WHL_AUDIT_ENABLE=1
+TFCI_WHL_AUDIT_PLAT=manylinux_2_27_x86_64
+TFCI_WHL_BAZEL_TEST_ENABLE=1
+TFCI_WHL_SIZE_LIMIT=300M
+TFCI_WHL_SIZE_LIMIT_ENABLE=1

ci/official/envs/linux_x86_cuda

@@ -0,0 +1,24 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+source ci/official/envs/linux_x86
+export TF_FORCE_GPU_ALLOW_GROWTH=true
+TFCI_BAZEL_COMMON_ARGS="--repo_env=HERMETIC_PYTHON_VERSION=$TFCI_PYTHON_VERSION --repo_env=USE_PYWRAP_RULES=True --config release_gpu_linux --test_env=TF_FORCE_GPU_ALLOW_GROWTH=true"
+TFCI_BAZEL_HERMETIC_CUDA_UMD_ENABLE=1
+TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX=linux_cuda
+TFCI_BUILD_PIP_PACKAGE_WHEEL_NAME_ARG="--repo_env=WHEEL_NAME=tensorflow"
+TFCI_DOCKER_ARGS="--gpus all"
+TFCI_LIB_SUFFIX="-gpu-linux-x86_64"
+# TODO: Set back to 610M once the wheel size is fixed.
+TFCI_WHL_SIZE_LIMIT=630M

ci/official/envs/linux_x86_cuda13_nvcc

@@ -0,0 +1,23 @@
+# Copyright 2026 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+source ci/official/envs/linux_x86
+TFCI_BAZEL_COMMON_ARGS="--repo_env=HERMETIC_PYTHON_VERSION=$TFCI_PYTHON_VERSION --repo_env=USE_PYWRAP_RULES=True --config release_gpu_linux --config=cuda_nvcc --config=cuda13_version"
+TFCI_BAZEL_HERMETIC_CUDA_UMD_ENABLE=1
+TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX=linux_cuda_13_nvcc
+TFCI_BUILD_PIP_PACKAGE_WHEEL_NAME_ARG="--repo_env=WHEEL_NAME=tensorflow_cuda13"
+TFCI_DOCKER_ARGS="--gpus all"
+TFCI_LIB_SUFFIX="-gpu-linux-x86_64"
+# TODO: Set back to 610M once the wheel size is fixed.
+TFCI_WHL_SIZE_LIMIT=630M

ci/official/envs/macos_arm64

@@ -0,0 +1,40 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+TFCI_BAZEL_COMMON_ARGS="--repo_env=HERMETIC_PYTHON_VERSION=$TFCI_PYTHON_VERSION --repo_env=USE_PYWRAP_RULES=True --config release_macos_arm64"
+TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX=macos_arm64
+TFCI_BUILD_PIP_PACKAGE_WHEEL_NAME_ARG="--repo_env=WHEEL_NAME=tensorflow"
+TFCI_INDEX_HTML_ENABLE=1
+TFCI_LIB_SUFFIX="-cpu-darwin-arm64"
+TFCI_MACOS_BAZEL_TEST_DIR_ENABLE=1
+TFCI_MACOS_BAZEL_TEST_DIR_PATH="/Volumes/BuildData/bazel_output"
+TFCI_OUTPUT_DIR=build_output
+TFCI_WHL_BAZEL_TEST_ENABLE=1
+TFCI_WHL_SIZE_LIMIT=245M
+TFCI_WHL_SIZE_LIMIT_ENABLE=1
+
+# 3.11 is the system python on our images
+case $TFCI_PYTHON_VERSION in
+3.11)
+  TFCI_MACOS_PYENV_INSTALL_ENABLE=0
+  ;;
+3.13)
+  TFCI_MACOS_UPGRADE_PYENV_ENABLE=1
+  TFCI_MACOS_PYENV_INSTALL_ENABLE=1
+  ;;
+*)
+  TFCI_MACOS_PYENV_INSTALL_ENABLE=1
+  ;;
+esac
+

ci/official/envs/nightly_upload

@@ -0,0 +1,36 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+# IMPORTANT: trailing slash is required on GCS URIs, as it tells gcloud to
+# pretend the path is a directory.
+# 1. Upload nightlies
+TFCI_ARTIFACT_FINAL_GAR_ARGS="--repository-url https://us-python.pkg.dev/ml-oss-artifacts-published/tf-public-nightly-artifacts-registry/ --verbose"
+TFCI_ARTIFACT_FINAL_GCS_ENABLE=1
+TFCI_ARTIFACT_FINAL_GCS_SA_PATH="${KOKORO_KEYSTORE_DIR}/73361_tensorflow_release_binary_uploader_service_account"
+TFCI_ARTIFACT_FINAL_GCS_URI="gs://tensorflow/nightly/"
+TFCI_ARTIFACT_FINAL_PYPI_ARGS="--config-file=$KOKORO_KEYSTORE_DIR/73361_tensorflow_pypirc_using_global_api_token --repository pypi-warehouse --verbose"
+TFCI_ARTIFACT_FINAL_PYPI_ENABLE=1
+TFCI_ARTIFACT_LATEST_GCS_URI="gs://tensorflow/nightly/latest/"
+TFCI_ARTIFACT_STAGING_GCS_ENABLE=1
+TFCI_ARTIFACT_STAGING_GCS_URI="gs://tensorflow-ci-staging/staging/nightly/$(git rev-parse HEAD)/"
+
+# 2. The internal version numbers get changed
+TFCI_NIGHTLY_UPDATE_VERSION_ENABLE=1
+
+# 3. Push results to public build cache (unique cache for MacOS)
+if [[ $(uname -s) == "Darwin" ]]; then
+  TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --config tf_public_macos_cache_push"
+else
+  TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --config tf_public_cache_push"
+fi

ci/official/envs/no_docker

@@ -0,0 +1,16 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+# Disable Docker
+TFCI_DOCKER_ENABLE=0

ci/official/envs/no_upload

@@ -0,0 +1,25 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+# Disable ALL uploads of any kind.
+TFCI_ARTIFACT_FINAL_GAR_ARGS=
+TFCI_ARTIFACT_FINAL_GCS_ENABLE=
+TFCI_ARTIFACT_FINAL_GCS_SA_PATH=
+TFCI_ARTIFACT_FINAL_GCS_URI=
+TFCI_ARTIFACT_FINAL_PYPI_ARGS=
+TFCI_ARTIFACT_FINAL_PYPI_ENABLE=
+TFCI_ARTIFACT_LATEST_GCS_URI=
+TFCI_ARTIFACT_STAGING_GCS_ENABLE=
+TFCI_ARTIFACT_STAGING_GCS_URI=
+TFCI_DOCKER_REBUILD_UPLOAD_ENABLE=

ci/official/envs/numpy1

@@ -0,0 +1,17 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+TFCI_BUILD_PIP_PACKAGE_WHEEL_NAME_ARG="--repo_env=WHEEL_NAME=tf_nightly_numpy1"
+TFCI_NIGHTLY_UPDATE_VERSION_ENABLE=1
+TFCI_WHL_NUMPY_VERSION=1

ci/official/envs/public_cache

@@ -0,0 +1,21 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+# Sourcing this enables Bazel remote cache (public, read-only)
+# The cache configs are different for MacOS and Linux
+if [[ $(uname -s) == "Darwin" ]]; then
+  TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --config tf_public_macos_cache"
+else
+  TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --config tf_public_cache"
+fi

ci/official/envs/public_cache_push

@@ -0,0 +1,26 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+# Sourcing this enables Bazel remote cache (read and write)
+# Note that "_push" cache configs write to GCS buckets and require
+# authentication. If you are not a Googler, source "public_cache" to enable the
+# public read-only cache.
+# The cache configs are different for MacOS and Linux
+if [[ $(uname -s) == "Darwin" ]]; then
+  TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --config tf_public_macos_cache_push"
+else
+  if [[ ! "$TFCI" =~ "rbe" ]]; then
+    TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --config tf_public_cache_push"
+  fi
+fi

ci/official/envs/py310

@@ -0,0 +1,15 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+TFCI_PYTHON_VERSION=3.10

ci/official/envs/py311

@@ -0,0 +1,15 @@
+# Copyright 2023 The TensorFlow Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+TFCI_PYTHON_VERSION=3.11