Resolve possible onnx CVE in python docs

.github/workflows/windows_gpu_doc_gen.yml

@@ -19,25 +19,59 @@ on:
     branches:
       - main
       - rel-*
-    paths:
-      - '**'
-      - '!docs/**'
-      - 'docs/OperatorKernels.md'
-      - 'docs/ContribOperators.md'
-      - '!README.md'
-      - '!CONTRIBUTING.md'
-      - '!BUILD.md'
-      - '!js/web/**'
-      - '!onnxruntime/core/providers/js/**'
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
   cancel-in-progress: true
 
 jobs:
-  kernel_documentation:
-    name: Windows GPU Kernel Documentation Validation
+  detect_changes:
+    name: Detect relevant changes
+    runs-on: ubuntu-latest
+    outputs:
+      run_documentation_build: ${{ steps.changes.outputs.run_documentation_build }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          submodules: 'none'
+
+      - name: Check changed paths
+        id: changes
+        shell: bash
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+        run: |
+          if [[ "$GITHUB_EVENT_NAME" != "pull_request" ]]; then
+            echo "run_documentation_build=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          run_documentation_build=false
+          while IFS= read -r path; do
+            case "$path" in
+              docs/OperatorKernels.md|docs/ContribOperators.md)
+                run_documentation_build=true
+                break
+                ;;
+              docs/*|README.md|CONTRIBUTING.md|BUILD.md|js/web/*|onnxruntime/core/providers/js/*)
+                ;;
+              *)
+                run_documentation_build=true
+                break
+                ;;
+            esac
+          done < <(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
+
+          echo "run_documentation_build=$run_documentation_build" >> "$GITHUB_OUTPUT"
+
+  kernel_documentation_build:
+    name: Windows GPU Kernel Documentation Build
+    needs: detect_changes
+    if: needs.detect_changes.outputs.run_documentation_build == 'true'
     env:
       OrtPackageId: Microsoft.ML.OnnxRuntime
       DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
@@ -170,3 +204,37 @@ jobs:
           path: |
             ${{ github.workspace }}/docs/OperatorKernels.md
             ${{ github.workspace }}/docs/ContribOperators.md
+
+  kernel_documentation:
+    name: Windows GPU Kernel Documentation Validation
+    needs:
+      - detect_changes
+      - kernel_documentation_build
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check documentation build result
+        env:
+          DETECT_CHANGES_RESULT: ${{ needs.detect_changes.result }}
+          RUN_DOCUMENTATION_BUILD: ${{ needs.detect_changes.outputs.run_documentation_build }}
+          DOCUMENTATION_BUILD_RESULT: ${{ needs.kernel_documentation_build.result }}
+        shell: bash
+        run: |
+          if [[ "$DETECT_CHANGES_RESULT" != "success" ]]; then
+            echo "::error::Failed to determine whether the documentation build is required."
+            exit 1
+          fi
+
+          if [[ "$RUN_DOCUMENTATION_BUILD" != "true" && "$RUN_DOCUMENTATION_BUILD" != "false" ]]; then
+            echo "::error::Unexpected path detection result: $RUN_DOCUMENTATION_BUILD"
+            exit 1
+          fi
+
+          if [[ "$RUN_DOCUMENTATION_BUILD" == "true" && "$DOCUMENTATION_BUILD_RESULT" != "success" ]]; then
+            echo "::error::Documentation build result: $DOCUMENTATION_BUILD_RESULT"
+            exit 1
+          fi
+
+          if [[ "$RUN_DOCUMENTATION_BUILD" != "true" ]]; then
+            echo "Documentation build is not required for the changed paths."
+          fi

docs/python/requirements.txt

@@ -16,7 +16,7 @@ numpy<2.0.0
 packaging
 protobuf>=4.25.8
 sympy
-onnx
+onnx >= 1.21.0
 sphinx_exec_code
 sphinx_tabs
 furo