Sync with Microsoft ONNX Runtime - 23082026

.github/actions/linux-web-init-and-check/action.yml

@@ -4,7 +4,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
       with:
         node-version: "22.x"
 

.github/actions/locate-vcvarsall-and-setup-env/action.yml

@@ -14,7 +14,7 @@ runs:
   steps:
 
     - name: Setup VCPKG
-      uses: microsoft/onnxruntime-github-actions/setup-build-tools@v0.0.9
+      uses: microsoft/onnxruntime-github-actions/setup-build-tools@d19341fb036c43a947a2c0e4a53ad4d15e10bc5c # v0.0.9
       with:
         vcpkg-version: '2025.08.27'
         vcpkg-hash: '9a4b32849792e13bee1d24726f073b3881acae4165206ddf1a6378e44a4ddd05b3ee93f55ff46d8e8873b3cbcd06606212989e248f0bd615a5bf365070074079'

.github/actions/macos-ci-setup/action.yml

@@ -30,7 +30,7 @@ runs:
   using: "composite"
   steps:
     - name: Use Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: ${{ inputs.python_version }}
 
@@ -42,7 +42,7 @@ runs:
         assert platform.machine().lower() == "${{ inputs.platform_machine}}", "This job expects to be run on an ${{ inputs.platform_machine}} machine."
 
     - name: Use Node.js
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
       with:
         node-version: ${{ inputs.node_version }}
 
@@ -51,7 +51,7 @@ runs:
       run: brew install coreutils ninja
 
     - name: Install Java
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       with:
         distribution: "temurin"
         java-version: ${{ inputs.java_version }}

.github/copilot-instructions.md

@@ -1,15 +1,4 @@
 # Copilot Instructions for ONNX Runtime
 
-For detailed codebase conventions, architecture, and coding standards, see [AGENTS.md](../AGENTS.md).
-
-## Code Review
-
-### No C API Version Bump Needed for API Additions
-
-`ORT_API_VERSION`, the `ort_api_1_to_N` function pointer table, and the version-boundary `static_assert` checks in
-`onnxruntime/core/session/onnxruntime_c_api.cc` are updated only during release preparation — not each time a new API
-is added. See [`docs/Versioning.md`](../docs/Versioning.md) for the full release versioning process.
-
-During development, new API function pointers are appended to the **current** `ort_api_1_to_N` table. This is the
-expected workflow and does **not** require a version bump, a new table, or new `static_assert` entries. Do not flag
-PRs that append new function pointers to the current table as needing a version bump.
+Read and follow [AGENTS.md](../AGENTS.md) for repository-wide guidance, including codebase conventions, architecture,
+and coding standards.

.github/dependabot.yml

@@ -18,3 +18,5 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7

.github/instructions/c-api.instructions.md

@@ -0,0 +1,46 @@
+---
+description: "C API implementation and review guidance for public C API updates."
+applyTo: "include/onnxruntime/core/session/onnxruntime_c_api.h,include/onnxruntime/core/session/onnxruntime_ep_c_api.h"
+---
+
+# C API Updates
+
+## API Structs and Initializers
+
+Preserve ABI compatibility for all shipped public C API members: do not remove, reorder, or change existing
+function-pointer signatures within a shipped C API struct.
+
+For a new public C API function, append its function pointer to the end of the applicable API struct and corresponding
+initializer. The append-only API structs are `OrtApi`, `OrtModelEditorApi`, `OrtCompileApi`, and `OrtInteropApi` in
+[`onnxruntime_c_api.h`](../../include/onnxruntime/core/session/onnxruntime_c_api.h), and `OrtEpApi` in
+[`onnxruntime_ep_c_api.h`](../../include/onnxruntime/core/session/onnxruntime_ep_c_api.h).
+
+For an `OrtApi` addition, append the implementation pointer to the current `ort_api_1_to_N` table. For the companion
+API structs, append it to the corresponding initializer in `model_editor_c_api.cc`, `compile_api.cc`, `interop_api.cc`,
+or `plugin_ep/ep_api.cc`.
+
+## API Documentation
+
+Fully document every new public C API member with Doxygen comments that explain its behavior, parameters, return value,
+and any ownership or lifetime requirements.
+
+Include a `\since Version X.Y.` tag identifying the first ONNX Runtime release that provides the API. `X.Y` should be
+`1.<current value of ORT_API_VERSION>`.
+
+## Release Versioning
+
+Do not bump `ORT_API_VERSION`, rename the current `OrtApi` version table, or add release-boundary markers or
+`static_assert` entries when adding a public C API function. Those changes are made during release preparation. See
+[Versioning](../../docs/Versioning.md) for the release versioning process.
+
+## C++ Wrappers
+
+Add a C++ API wrapper consistent with existing C++ API conventions for each new public C API, as appropriate. For
+example, a C++ wrapper is appropriate if it removes the need for manual resource management, or allows use of
+conventional C++ types.
+
+Add C++ API declarations to
+[`onnxruntime_cxx_api.h`](../../include/onnxruntime/core/session/onnxruntime_cxx_api.h) and implementation to
+[`onnxruntime_cxx_inline.h`](../../include/onnxruntime/core/session/onnxruntime_cxx_inline.h).
+
+If a C++ wrapper is not appropriate, document the reason in the pull request.

.github/skills/code-review/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: code-review
+description: "Review ONNX Runtime pull requests, branches, commits, patches, and working-tree changes for actionable findings and missing tests."
+---
+
+# Reviewing ONNX Runtime Code Changes
+
+Use this workflow for code review.
+
+## 1. Establish the review scope
+
+Determine the review base before analyzing the change. Identify the exact commits or working-tree state being reviewed,
+then enumerate all changed files.
+
+If no changed files are found, respond with: "No changes detected. Please specify a commit range, branch, or patch to
+review."
+
+Read every `.github/instructions/**/*.instructions.md` file whose `applyTo` scope matches a changed path. Also load each
+domain skill whose description matches the changed subsystem or behavior.
+
+If no instructions file or domain skill matches a changed path, proceed using general ONNX Runtime and
+language-specific conventions.
+
+## 2. Analyze changed behavior
+
+Review the diff in context, including controlling code, relevant callers, and affected tests. Trace inputs through the
+changed behavior to externally visible results or failure modes.
+
+Distinguish defects introduced by the change from pre-existing issues.
+
+Ensure coverage of all the following:
+
+- correctness and security;
+- ABI and API compatibility;
+- memory safety and concurrency;
+- portability across supported platforms and configurations;
+- missing tests for behavior changed by the diff.
+
+Also report actionable clarity and maintainability concerns, even when they are not correctness defects.
+
+Do not report formatting issues already enforced by repository tooling.
+
+## 3. Report findings
+
+Report each actionable finding separately, using an inline comment when supported. Each finding must include:
+
+- the file and line where the finding applies;
+- concrete evidence or a triggering scenario;
+- the resulting impact;
+- an actionable correction.
+
+If no actionable findings are found, say so explicitly.

.github/workflows/android.yml

@@ -34,7 +34,7 @@ jobs:
       CCACHE_DIR: ~/.cache/ccache # explicitly set to prevent any fallback to `~/.ccache`
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         submodules: false
 
@@ -127,10 +127,10 @@ jobs:
     env:
       CCACHE_DIR: ~/.cache/ccache # explicitly set to prevent any fallback to `~/.ccache`
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Use jdk 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -153,14 +153,14 @@ jobs:
           ndk-version: 28.0.13004108
 
       - name: Setup CCache
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           # Fully qualify by workflow. `actions/cache` does not isolate by workflow, unlike ADO cache actions.
           key: ccache | android.yml | android_nnapi_ep
           path: ~/.cache/ccache
 
       - name: Setup VCPKG Cache
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           key: vcpkg-cache | android.yml | android_nnapi_ep
           path: ~/.cache/vcpkg
@@ -233,10 +233,10 @@ jobs:
     env:
       CCACHE_DIR: ~/.cache/ccache # explicitly set to prevent any fallback to `~/.ccache`
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Use jdk 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -259,14 +259,14 @@ jobs:
           ndk-version: 28.0.13004108
 
       - name: Setup CCache
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           # Fully qualify by workflow. `actions/cache` does not isolate by workflow, unlike ADO cache actions.
           key: ccache | android.yml | android_cpu_ep
           path: ~/.cache/ccache
 
       - name: Setup VCPKG Cache
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           key: vcpkg-cache | android.yml | android_cpu_ep
           path: ~/.cache/vcpkg

.github/workflows/cffconvert.yml

@@ -17,9 +17,9 @@ jobs:
     timeout-minutes: 120
     steps:
       - name: Check out a copy of the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Check whether the citation metadata from CITATION.cff is valid
-        uses: citation-file-format/cffconvert-github-action@2.0.0
+        uses: citation-file-format/cffconvert-github-action@4cf11baa70a673bfdf9dad0acc7ee33b3f4b6084 # 2.0.0
         with:
           args: "--validate"

.github/workflows/codeql.yml

@@ -43,11 +43,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
     # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7
         with:
           languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,21 +60,21 @@ jobs:
     # Setup Java to use a version that is not too old for the project
       - if: ${{ matrix.language == 'java' }}
         name: Setup Java 11
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: '11'
           distribution: 'microsoft'
 
       - if: ${{ matrix.language == 'javascript' }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 20
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
       - if: ${{ matrix.language != 'cpp' }}
         name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7

.github/workflows/gradle-wrapper-validation.yml

@@ -20,8 +20,8 @@ jobs:
         ]
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v6
-      - uses: gradle/actions/wrapper-validation@v5
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: gradle/actions/wrapper-validation@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
   cancel-in-progress: true

.github/workflows/ios.yml

@@ -20,10 +20,10 @@ jobs:
     runs-on: macos-15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           submodules: false
-      - uses: microsoft/onnxruntime-github-actions/setup-build-tools@v0.0.9
+      - uses: microsoft/onnxruntime-github-actions/setup-build-tools@d19341fb036c43a947a2c0e4a53ad4d15e10bc5c # v0.0.9
         with:
           vcpkg-version: '2025.08.27'
           vcpkg-hash: 9a4b32849792e13bee1d24726f073b3881acae4165206ddf1a6378e44a4ddd05b3ee93f55ff46d8e8873b3cbcd06606212989e248f0bd615a5bf365070074079

.github/workflows/labeler.yml

@@ -15,7 +15,7 @@ jobs:
         ]
     timeout-minutes: 120
     steps:
-    - uses: github/issue-labeler@v3.4
+    - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         configuration-path: .github/labeler.yml

.github/workflows/lint.yml

@@ -18,17 +18,17 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: misspell # Check spellings as well
-        uses: reviewdog/action-misspell@v1
+        uses: reviewdog/action-misspell@d6429416b12b09b4e2768307d53bef58d172e962 # v1.27.0
         with:
           github_token: ${{ secrets.github_token }}
           locale: "US"
           reporter: github-pr-check
           level: info
           filter_mode: diff_context
       - name: shellcheck # Static check shell scripts
-        uses: reviewdog/action-shellcheck@v1.31.0
+        uses: reviewdog/action-shellcheck@1bb9751763fdfbee4b5043772c37374f103bff9e # v1.31.0
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-pr-check
@@ -48,14 +48,14 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           # Use the version configured in target-version of [tool.black] section in pyproject.toml.
           python-version: "3.10"
       - name: Setup Rust
-        uses: actions-rs/toolchain@v1
+        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
         with:
           toolchain: stable
           components: rustfmt
@@ -82,7 +82,7 @@ jobs:
       - name: Upload SARIF file
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3.37.7
         with:
           # Path to SARIF file relative to the root of the repository
           sarif_file: lintrunner.sarif
@@ -94,7 +94,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Update PATH
         run: |
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"