Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/codeql-analysis.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,13 +30,13 @@ jobs:
- name: Checkout
uses: actions/checkout@v3
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
- name: Autobuild
uses: github/codeql-action/autobuild@v2
uses: github/codeql-action/autobuild@v3
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
uses: github/codeql-action/analyze@v3
analyze-cpp:
name: CodeQL analyze cpp
runs-on: ubuntu-latest
Expand All @@ -54,10 +54,10 @@ jobs:
DEBIAN_FRONTEND=noninteractive apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install -y ffmpeg libavcodec-dev libavformat-dev libavutil-dev libswresample-dev sudo
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
uses: github/codeql-action/init@v3
with:
languages: cpp
- name: Build
run: make cppbuild -j
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
uses: github/codeql-action/analyze@v3
14 changes: 13 additions & 1 deletion dockerfile/cuda11.1.1.dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ RUN apt-get update && \
automake \
bc \
build-essential \
ca-certificates \
curl \
dmidecode \
ffmpeg \
Expand All @@ -50,7 +51,13 @@ RUN apt-get update && \
util-linux \
vim \
wget \
software-properties-common \
&& \
add-apt-repository -y ppa:longsleep/golang-backports && \
apt-get update && \
apt-get install -y golang-1.24-go=1.24* && \
Comment on lines +56 to +58
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding the third-party PPA ppa:longsleep/golang-backports and installing golang-1.24-go from it introduces a supply-chain risk because the build runs package installation scripts from an external, mutable repository with root privileges. If that PPA or its distribution path is compromised, an attacker could ship a malicious Go toolchain that executes during image build and later inside any container based on this image. Prefer using an official, vendor-maintained source or a pinned, verified artifact (e.g., with a checksum or signature) so the exact bits executed in the build are controlled and auditable.

Copilot uses AI. Check for mistakes.
update-alternatives --install /usr/bin/go go /usr/lib/go-1.24/bin/go 100 && \
update-alternatives --install /usr/bin/gofmt gofmt /usr/lib/go-1.24/bin/gofmt 100 && \
apt-get autoremove && \
apt-get clean && \
rm -rf /var/lib/apt/lists/* /tmp/* /opt/cmake-3.14.6-Linux-x86_64
Expand Down Expand Up @@ -149,7 +156,12 @@ ADD dockerfile/etc /opt/microsoft/
WORKDIR ${SB_HOME}

ADD third_party third_party
RUN make -C third_party cuda -o nvbandwidth
# Install Rust temporarily for wandb build (required by megatron_lm target), then remove
RUN curl https://sh.rustup.rs -sSf | sh -s -- -y && \
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Executing curl https://sh.rustup.rs -sSf | sh -s -- -y during the Docker build runs remote code from the network as root without any integrity verification. If the Rust installer endpoint, DNS, or any point on the TLS path is compromised, an attacker can supply arbitrary shell script content, compromising the build container and any artifacts or secrets handled there. Prefer fetching a specific, versioned installer artifact and verifying its checksum or signature before execution, or using a trusted package manager source where possible.

Copilot uses AI. Check for mistakes.
. /root/.cargo/env && \
make -C third_party cuda -o nvbandwidth && \
rustup self uninstall -y && \
rm -rf /root/.cargo /root/.rustup

ADD . .
RUN python3 -m pip install --upgrade setuptools==65.7 importlib_metadata==6.8.0 && \
Expand Down
4 changes: 2 additions & 2 deletions superbench/analyzer/file_handler.py
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ def output_excel_raw_data(writer, raw_data_df, sheet_name):
"""
# Output the raw data
if isinstance(raw_data_df, pd.DataFrame) and not raw_data_df.empty:
raw_data_df.to_excel(writer, sheet_name, index=True)
raw_data_df.to_excel(writer, sheet_name=sheet_name, index=True)
else:
logger.warning('FileHandler: excel_data_output - {} data_df is empty.'.format(sheet_name))

Expand All @@ -114,7 +114,7 @@ def output_excel_data_not_accept(writer, data_not_accept_df, rules):

# Output the not accept
if isinstance(data_not_accept_df, pd.DataFrame):
data_not_accept_df.to_excel(writer, 'Not Accept', index=True)
data_not_accept_df.to_excel(writer, sheet_name='Not Accept', index=True)
if not data_not_accept_df.empty:
row_start = 1
row_end = max(row_start, len(data_not_accept_df))
Expand Down
4 changes: 2 additions & 2 deletions superbench/analyzer/result_summary.py
Original file line number Diff line number Diff line change
Expand Up @@ -185,7 +185,7 @@ def generate_md_lines(self, summary):
for category in summary:
lines.append('## {}\n'.format(category))
summary_df = pd.DataFrame(summary[category])
summary_df = summary_df.drop(columns=0, axis=1)
summary_df = summary_df.drop(columns=[0])
header = ['metric', 'statistics', 'values']
table_lines = file_handler.generate_md_table(summary_df, header)
lines.extend(table_lines)
Expand All @@ -210,7 +210,7 @@ def output_summary_in_excel(self, raw_data_df, summary, output_path):
file_handler.output_excel_raw_data(writer, raw_data_df, 'Raw Data')
# output the result summary in 'Summary' sheet
if isinstance(summary, pd.DataFrame) and not summary.empty:
summary.to_excel(writer, 'Summary', index=False, header=False)
summary.to_excel(writer, sheet_name='Summary', index=False, header=False)
worksheet = writer.sheets['Summary']
row = worksheet.max_row
# merge cells in 'category' column with the same category
Expand Down
12 changes: 8 additions & 4 deletions superbench/benchmarks/base.py
Original file line number Diff line number Diff line change
Expand Up @@ -293,10 +293,14 @@ def _process_percentile_result(self, metric, result, reduce_type=None):
if len(result) > 0:
percentile_list = ['50', '90', '95', '99', '99.9']
for percentile in percentile_list:
self._result.add_result(
'{}_{}'.format(metric, percentile),
np.percentile(result, float(percentile), interpolation='nearest'), reduce_type
)
try:
# Prefer the newer NumPy 'method' argument; fall back to 'interpolation'
# for older NumPy versions that don't support 'method'.
val = np.percentile(result, float(percentile), method='nearest')
except TypeError:
# If the 'method' argument is not supported (older NumPy), retry with 'interpolation'.
val = np.percentile(result, float(percentile), interpolation='nearest')
self._result.add_result('{}_{}'.format(metric, percentile), val, reduce_type)

def print_env_info(self):
"""Print environments or dependencies information."""
Expand Down
Loading