From 64aef7dc8045387e30789123c4557b2d7707961f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 22 Mar 2026 19:29:30 +0000 Subject: [PATCH 1/6] ci: update Triton pin to c60fd503 --- ci/triton-hash.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/triton-hash.txt b/ci/triton-hash.txt index 82ff356..6a90ad4 100644 --- a/ci/triton-hash.txt +++ b/ci/triton-hash.txt @@ -1 +1 @@ -443f4fe96e1073cde55a2fd18fd344f1035a20dc +c60fd50377344ebce1f3102cf14211189b69184f From 0ce1434f22781da5178f173bc7593d9ebbb80b8c Mon Sep 17 00:00:00 2001 From: Andrew Brown Date: Mon, 23 Mar 2026 09:28:24 -0700 Subject: [PATCH 2/6] ci: start building Clang into the LLVM artifacts Upstream's #9642 adds in Clang to their LLVM build in order to have it available for `GSanLibrary.cu`. This adds the `clang` component here as well as a few other minor things that have changed with the LLVM build. [#9642]: https://github.com/triton-lang/triton/pull/9642 --- .github/actions/build-llvm/action.yml | 10 ++++++---- .github/workflows/ci.yml | 3 +++ 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/actions/build-llvm/action.yml b/.github/actions/build-llvm/action.yml index 341f8fc..bb1ad59 100644 --- a/.github/actions/build-llvm/action.yml +++ b/.github/actions/build-llvm/action.yml @@ -102,17 +102,19 @@ runs: -DCMAKE_C_COMPILER_LAUNCHER=sccache -DCMAKE_CXX_COMPILER_LAUNCHER=sccache -DCMAKE_INSTALL_PREFIX="${{ env.llvm_install_dir }}" -DCMAKE_LINKER=lld + -DCMAKE_OSX_ARCHITECTURES=arm64 -DLLVM_BUILD_UTILS=ON -DBUILD_SHARED_LIBS=ON -DLLVM_BUILD_SHARED_LIBS=ON -DLLVM_BUILD_TOOLS=ON -DLLVM_ENABLE_ASSERTIONS=ON -DMLIR_ENABLE_BINDINGS_PYTHON=OFF - -DLLVM_ENABLE_PROJECTS="mlir;lld" - -DLLVM_INSTALL_UTILS=ON - -DLLVM_TARGETS_TO_BUILD="host;NVPTX;AMDGPU" - -DLLVM_ENABLE_TERMINFO=OFF + -DLLVM_ENABLE_PROJECTS="mlir;lld;clang" -DLLVM_ENABLE_ZSTD=OFF + -DLLVM_INSTALL_UTILS=ON + -DLLVM_TARGETS_TO_BUILD="AArch64;NVPTX;AMDGPU" + -DLLVM_USE_HOST_TOOLS=ON + -DLLVM_ABI_BREAKING_CHECKS=FORCE_OFF llvm-project/llvm ninja -C llvm-project/build check-mlir install diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 96afa1c..8d46096 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -95,6 +95,9 @@ jobs: run: | python ci/download-artifact.py ${{ steps.build-llvm.outputs.llvm_install_dir }} + - name: Find clang++ + run: which clang++ + - name: Build Triton id: build-triton uses: ./.github/actions/build-triton From b99b4fac234f0bd0d087a8f2326fc41ee2799848 Mon Sep 17 00:00:00 2001 From: Andrew Brown Date: Mon, 23 Mar 2026 13:35:33 -0700 Subject: [PATCH 3/6] Allow extracting symlinks pointing inside the extraction directory; e.g., `clang++ -> clang` --- ci/download-artifact.py | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/ci/download-artifact.py b/ci/download-artifact.py index 34f701e..c53172b 100755 --- a/ci/download-artifact.py +++ b/ci/download-artifact.py @@ -84,11 +84,19 @@ def download_artifact(repository, artifact_name): return artifact_file -def filter_data_no_symlinks(tarinfo, path): - """Apply 'data' filter behavior but skip symlinks.""" - # Skip symlinks. +def is_contained_path(path): + """Check if a path is contained (i.e., does not contain '..' or start with '/').""" + return not (path.startswith('/') or '..' in path) + + +def filter_data(tarinfo, path): + """Apply 'data' filter behavior but skip certain symlinks.""" + # Skip symlinks if they point outside the extraction directory. if tarinfo.issym() or tarinfo.islnk(): - return None + if not is_contained_path(tarinfo.linkname): + logging.warning( + f"Skipping symlink: {tarinfo.name} -> {tarinfo.linkname}") + return None # Apply 'data' filter behavior: strip dangerous metadata, but preserve # executability for files that were executable in the archive. @@ -99,8 +107,9 @@ def filter_data_no_symlinks(tarinfo, path): tarinfo.uid = tarinfo.gid = 0 tarinfo.uname = tarinfo.gname = "" - # Block absolute paths and paths with '..'. - if tarinfo.name.startswith('/') or '..' in tarinfo.name: + # Block paths outside the extraction directory. + if not is_contained_path(tarinfo.name): + logging.warning(f"Skipping potentially unsafe path: {tarinfo.name}") return None return tarinfo @@ -116,7 +125,7 @@ def extract_artifact(artifact_file): logging.debug(f"Extracting artifact: {artifact_file}") try: with tarfile.open(artifact_file, "r:gz") as tar: - tar.extractall(filter=filter_data_no_symlinks) + tar.extractall(filter=filter_data) except Exception as e: logging.error(f"Error extracting artifact: {e}") sys.exit(1) From 325b9ec65ee027df69a6c934b49266bf27e96689 Mon Sep 17 00:00:00 2001 From: Andrew Brown Date: Mon, 23 Mar 2026 14:05:41 -0700 Subject: [PATCH 4/6] ci: also build `llvm` component --- .github/actions/build-llvm/action.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/actions/build-llvm/action.yml b/.github/actions/build-llvm/action.yml index bb1ad59..c336ce8 100644 --- a/.github/actions/build-llvm/action.yml +++ b/.github/actions/build-llvm/action.yml @@ -102,17 +102,16 @@ runs: -DCMAKE_C_COMPILER_LAUNCHER=sccache -DCMAKE_CXX_COMPILER_LAUNCHER=sccache -DCMAKE_INSTALL_PREFIX="${{ env.llvm_install_dir }}" -DCMAKE_LINKER=lld - -DCMAKE_OSX_ARCHITECTURES=arm64 -DLLVM_BUILD_UTILS=ON - -DBUILD_SHARED_LIBS=ON - -DLLVM_BUILD_SHARED_LIBS=ON -DLLVM_BUILD_TOOLS=ON + -DLLVM_BUILD_SHARED_LIBS=ON + -DBUILD_SHARED_LIBS=ON -DLLVM_ENABLE_ASSERTIONS=ON -DMLIR_ENABLE_BINDINGS_PYTHON=OFF - -DLLVM_ENABLE_PROJECTS="mlir;lld;clang" + -DLLVM_ENABLE_PROJECTS="mlir;llvm;lld;clang" -DLLVM_ENABLE_ZSTD=OFF -DLLVM_INSTALL_UTILS=ON - -DLLVM_TARGETS_TO_BUILD="AArch64;NVPTX;AMDGPU" + -DLLVM_TARGETS_TO_BUILD="host;NVPTX;AMDGPU" -DLLVM_USE_HOST_TOOLS=ON -DLLVM_ABI_BREAKING_CHECKS=FORCE_OFF llvm-project/llvm From 40b97fabfe5f80bb314866186766ec63b144d454 Mon Sep 17 00:00:00 2001 From: Andrew Brown Date: Wed, 25 Mar 2026 17:12:39 -0700 Subject: [PATCH 5/6] Introduce temporary fix to allow building plugins --- CMakeLists.txt | 3 +++ support/python/src/ir.h | 7 +++++++ 2 files changed, 10 insertions(+) create mode 100644 support/python/src/ir.h diff --git a/CMakeLists.txt b/CMakeLists.txt index 93b0964..a3385ab 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -36,6 +36,9 @@ include(TableGen) # required by AddMLIR include(AddLLVM) include(AddMLIR) +# Temporary workaround for missing header (see `support/python/src/ir.h`). +include_directories(${TRITON_EXT_SUPPORT_DIR}) + # Build common infrastructure files. add_subdirectory(${TRITON_EXT_SUPPORT_DIR}) diff --git a/support/python/src/ir.h b/support/python/src/ir.h new file mode 100644 index 0000000..24faf34 --- /dev/null +++ b/support/python/src/ir.h @@ -0,0 +1,7 @@ +// This is a forward declaration to avoid a build error introduced in +// https://github.com/triton-lang/triton/pull/9626. The problem is that +// `PluginUtils.h` depends on this class in `python/src/ir.h` for the builder +// necessary to add custom operations. Including this file temporarily resolves +// the missing header; when that is fixed upstream (e.g., +// https://github.com/triton-lang/triton/pull/9847), this file can be removed. +class TritonOpBuilder; From 96450643c8248a3c316551596abf3af4c717f43a Mon Sep 17 00:00:00 2001 From: Andrew Brown Date: Wed, 25 Mar 2026 17:15:07 -0700 Subject: [PATCH 6/6] ci: remove debugging step --- .github/workflows/ci.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8d46096..96afa1c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -95,9 +95,6 @@ jobs: run: | python ci/download-artifact.py ${{ steps.build-llvm.outputs.llvm_install_dir }} - - name: Find clang++ - run: which clang++ - - name: Build Triton id: build-triton uses: ./.github/actions/build-triton