| Workflow | When it runs | What it does |
|---|---|---|
| CI | Every PR, merge_group, push to main, daily (midnight UTC) | C++ and Python tests across Linux, Windows, macOS; Python 3.10–3.14 (including free-threading variants); doc generation; proto generation; node test generation; daily run reports code coverage to Codecov |
| Windows_No_Exception_CI | Push and PR to main and rel-* | C++ tests compiled without exceptions; selective schema loading |
| Lint / Optional Lint | Every PR | Not required — posts misspell, shellcheck, and cpplint suggestions as PR review comments |
| Lint / Enforce style | Every PR | Required — runs lintrunner (ruff, mypy, clang-format, etc.) and verifies auto-generated files are up to date |
| Reuse | Every PR | Checks copyright and license headers; see https://reuse.software/. Files without a recognized license must be configured in REUSE.toml. |
| Require label | Every PR | Requires at least one topic: or module: label (skipped for Dependabot PRs) |
| PR Checks | PRs to main | Computes and posts auto-fix suggestions as PR review comments (via PR Checks Post) |
| Optional Clang-Tidy Review | PRs to main/rel-* that touch C++ files | Not required — posts clang-tidy diagnostics as PR review comments |
| DCO | merge_group | Placeholder DCO job required to enable the GitHub merge queue |
| Workflow | When it runs | What it does |
|---|---|---|
| Create Releases | Push to main/rel-*, PRs targeting rel-* or labeled "run release CIs", weekly (Monday 00:00 UTC), workflow_dispatch | Orchestrator — calls WindowsRelease, LinuxRelease, MacRelease, and sdistRelease as reusable workflows |
| WindowsRelease | Called by Create Releases | Builds Windows wheels for x64, x86, and arm64; verifies with min and latest numpy/protobuf; verifies with latest ONNX Runtime PyPI package (2)(3) |
| LinuxRelease | Called by Create Releases | Builds Linux wheels for x86_64 (manylinux_2_28) and aarch64; verifies with min and latest numpy/protobuf; verifies with latest ONNX Runtime PyPI package |
| MacRelease | Called by Create Releases | Builds macOS wheels (macos-14, MACOSX_DEPLOYMENT_TARGET=12.0); verifies with min and latest numpy/protobuf; verifies with latest ONNX Runtime PyPI package; tests source distribution build |
| sdistRelease | Called by Create Releases | Builds and tests source distribution |
| Workflow | When it runs | What it does |
|---|---|---|
| CodeQL | Every PR, push to main/rel-*, weekly (Friday) | Static analysis of C++ and Python for security vulnerabilities |
| Scorecard | Push to main, weekly (Saturday) | OpenSSF supply-chain security scorecard; publishes results to code-scanning dashboard |
| Zizmor | Every PR, push to main | Security analysis of GitHub Actions workflow files |
| Dependency Review | Every PR | Flags vulnerable or license-incompatible dependencies introduced by a PR |
| Workflow | When it runs | What it does |
|---|---|---|
| Pages | PRs to main, push to main | Builds and publishes ONNX documentation to GitHub Pages |
| Auto update documentation | PRs labeled "auto update doc" | Regenerates docs and backend test data directly in the PR branch |
| Pixi CI | Weekly (Sunday 23:59 UTC), push when pixi files change | Builds and tests with the pixi environment manager on Linux, macOS, and Windows; opens an issue on failure |
| Check URLs | Push to main/rel-*, monthly | Checks for broken URLs in the codebase |
| Stale | Daily | Warns and eventually closes stale issues and PRs |
| Dependabot | Monthly | Creates PRs for updated dependency versions |
-
(1) Release CIs run when:
- A PR is merged into main or a rel-* branch
- Weekly (Monday 00:00 UTC) — publishes a Python wheel to the onnx-weekly package on PyPI
- Any PR targeting a rel-* branch
- Any PR labeled "run release CIs" (maintainers only)
- Manually via workflow_dispatch
-
(2) Minimum supported dependency versions are listed in requirements.txt.
-
(3) Tests the ONNX Python wheel with
onnxruntime.InferenceSessionfrom the latest ONNX Runtime release on PyPI.