Skip to content

Commit 60a421d

Browse files
brunopistonebrunopistone
committed
2 parents f6840d1 + 73a1a62 commit 60a421d

File tree

193 files changed

+11359
-1319
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

193 files changed

+11359
-1319
lines changed

‎.github/workflows/codeql.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: "CodeQL"
2+
on:
3+
push:
4+
branches: [ "master" ]
5+
pull_request:
6+
branches: [ "master" ]
7+
schedule:
8+
- cron: '30 8 * * *'
9+
jobs:
10+
analyze:
11+
name: Analyze (${{ matrix.language }})
12+
runs-on: ${{ 'ubuntu-latest' }}
13+
permissions:
14+
security-events: write
15+
packages: read
16+
17+
strategy:
18+
matrix:
19+
include:
20+
- language: python
21+
build-mode: none
22+
- language: java-kotlin
23+
build-mode: none
24+
steps:
25+
- name: Checkout repository
26+
uses: actions/checkout@6ccd57f4c5d15bdc2fef309bd9fb6cc9db2ef1c6
27+
- name: Initialize CodeQL
28+
uses: github/codeql-action/init@4b1d7da102ff94aca014c0245062b1a463356d72
29+
with:
30+
languages: ${{ matrix.language }}
31+
build-mode: ${{ matrix.build-mode }}
32+
- name: Perform CodeQL Analysis
33+
uses: github/codeql-action/analyze@4b1d7da102ff94aca014c0245062b1a463356d72
34+
with:
35+
category: "/language:${{matrix.language}}"

‎.github/workflows/security-monitoring.yml

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
name: Security Monitoring
2+
3+
on:
4+
schedule:
5+
- cron: '0 9 * * *'
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.run_id }}
9+
cancel-in-progress: true
10+
11+
permissions:
12+
id-token: write
13+
14+
jobs:
15+
check-code-scanning-alerts:
16+
runs-on: ubuntu-latest
17+
outputs:
18+
code_scanning_alert_status: ${{ steps.check-code-scanning-alerts.outputs.code_scanning_alert_status }}
19+
steps:
20+
- name: Check for security alerts
21+
id: check-code-scanning-alerts
22+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
23+
with:
24+
github-token: ${{ secrets.GH_PAT }}
25+
script: |
26+
async function checkAlerts() {
27+
const owner = '${{ github.repository_owner }}';
28+
const repo = '${{ github.event.repository.name }}';
29+
const ref = 'refs/heads/master';
30+
31+
const codeScanningAlerts = await github.rest.codeScanning.listAlertsForRepo({
32+
owner,
33+
repo,
34+
ref: ref
35+
});
36+
const activeCodeScanningAlerts = codeScanningAlerts.data.filter(alert => alert.state === 'open');
37+
core.setOutput('code_scanning_alert_status', activeCodeScanningAlerts.length > 0 ? '1': '0');
38+
}
39+
await checkAlerts();
40+
41+
check-dependabot-alerts:
42+
runs-on: ubuntu-latest
43+
outputs:
44+
dependabot_alert_status: ${{ steps.check-dependabot-alerts.outputs.dependabot_alert_status }}
45+
steps:
46+
- name: Check for dependabot alerts
47+
id: check-dependabot-alerts
48+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
49+
with:
50+
github-token: ${{ secrets.GH_PAT }}
51+
script: |
52+
async function checkAlerts() {
53+
const owner = '${{ github.repository_owner }}';
54+
const repo = '${{ github.event.repository.name }}';
55+
56+
const dependabotAlerts = await github.rest.dependabot.listAlertsForRepo({
57+
owner,
58+
repo,
59+
headers: {
60+
'accept': 'applications/vnd.github+json'
61+
}
62+
});
63+
const activeDependabotAlerts = dependabotAlerts.data.filter(alert => alert.state === 'open');
64+
core.setOutput('dependabot_alert_status', activeDependabotAlerts.length > 0 ? '1': '0');
65+
}
66+
await checkAlerts();
67+
68+
check-secret-scanning-alerts:
69+
runs-on: ubuntu-latest
70+
outputs:
71+
secret_scanning_alert_status: ${{ steps.check-secret-scanning-alerts.outputs.secret_scanning_alert_status }}
72+
steps:
73+
- name: Check for secret scanning alerts
74+
id: check-secret-scanning-alerts
75+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
76+
with:
77+
github-token: ${{ secrets.GH_PAT }}
78+
script: |
79+
async function checkAlerts() {
80+
const owner = '${{ github.repository_owner }}';
81+
const repo = '${{ github.event.repository.name }}';
82+
83+
const secretScanningAlerts = await github.rest.secretScanning.listAlertsForRepo({
84+
owner,
85+
repo,
86+
});
87+
const activeSecretScanningAlerts = secretScanningAlerts.data.filter(alert => alert.state === 'open');
88+
core.setOutput('secret_scanning_alert_status', activeSecretScanningAlerts.length > 0 ? '1': '0');
89+
console.log("Active Secret Scanning Alerts", activeSecretScanningAlerts);
90+
}
91+
await checkAlerts();
92+
93+
put-metric-data:
94+
runs-on: ubuntu-latest
95+
needs: [check-code-scanning-alerts, check-dependabot-alerts, check-secret-scanning-alerts]
96+
steps:
97+
- name: Configure AWS Credentials
98+
uses: aws-actions/configure-aws-credentials@12e3392609eaaceb7ae6191b3f54bbcb85b5002b
99+
with:
100+
role-to-assume: ${{ secrets.MONITORING_ROLE_ARN }}
101+
aws-region: us-west-2
102+
- name: Put Code Scanning Alert Metric Data
103+
run: |
104+
if [ "${{ needs.check-code-scanning-alerts.outputs.code_scanning_alert_status }}" == "1" ]; then
105+
aws cloudwatch put-metric-data --metric-name CodeScanningAlert --namespace SecurityMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk
106+
else
107+
aws cloudwatch put-metric-data --metric-name CodeScanningAlert --namespace SecurityMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk
108+
fi
109+
- name: Put Dependabot Alert Metric Data
110+
run: |
111+
if [ "${{ needs.check-dependabot-alerts.outputs.dependabot_alert_status }}" == "1" ]; then
112+
aws cloudwatch put-metric-data --metric-name DependabotAlert --namespace SecurityMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk
113+
else
114+
aws cloudwatch put-metric-data --metric-name DependabotAlert --namespace SecurityMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk
115+
fi
116+
- name: Put Secret Scanning Alert Metric Data
117+
run: |
118+
if [ "${{ needs.check-secret-scanning-alerts.outputs.secret_scanning_alert_status }}" == "1" ]; then
119+
aws cloudwatch put-metric-data --metric-name SecretScanningAlert --namespace SecurityMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk
120+
else
121+
aws cloudwatch put-metric-data --metric-name SecretScanningAlert --namespace SecurityMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk
122+
fi

‎CHANGELOG.md

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,82 @@
11
# Changelog
22

3+
## v2.228.0 (2024-08-06)
4+
5+
### Features
6+
7+
* triton v24.05
8+
9+
### Bug Fixes and Other Changes
10+
11+
* chore: telemetry for deployment configs
12+
* censoring sensitive values from being logged
13+
* update image_uri_configs 08-05-2024 07:17:38 PST
14+
* enable uncompressed model artifacts upload to S3 for SAGEMAKER_ENDPOINT overwrite for TGI, TEI, MMS model servers
15+
* ModelReference deployment for Alt Configs models
16+
* Add optional typecheck for nullable parameters
17+
* Update package metadata
18+
* release TEI 1.4.0
19+
20+
## v2.227.0 (2024-07-30)
21+
22+
### Features
23+
24+
* added code scanning through CodeQL
25+
26+
### Bug Fixes and Other Changes
27+
28+
* Fixed cpu isntance type for the estimator register test
29+
* update image_uri_configs 07-29-2024 11:28:28 PST
30+
* avoid AccessDenied error for a while on SageMaker Studio wtih do…
31+
* SMP PT 2.3 Fix
32+
* chore: pin framework version in serverless inference tests
33+
* image uri in TGI 2.2.0 image
34+
* explicitly access enum member values to avoid Python version related regression
35+
* chore: add huggingface TGI 2.2.0 config
36+
* update image_uri_configs 07-22-2024 11:53:54 PST
37+
* update image_uri_configs 07-17-2024 07:17:38 PST
38+
* update image_uri_configs 07-16-2024 07:17:45 PST
39+
* add support for new regions
40+
41+
## v2.226.1 (2024-07-17)
42+
43+
## v2.226.0 (2024-07-12)
44+
45+
### Features
46+
47+
* Curated hub improvements
48+
* InferenceSpec support for MMS and testing
49+
50+
### Bug Fixes and Other Changes
51+
52+
* ModelBuilder not passing HF_TOKEN to model.
53+
* update image_uri_configs 07-10-2024 07:18:04 PST
54+
55+
## v2.225.0 (2024-07-10)
56+
57+
### Features
58+
59+
* model optimization
60+
61+
### Bug Fixes and Other Changes
62+
63+
* fix integ test
64+
* update uris for v1.1.1
65+
* update image_uri_configs 07-04-2024 07:17:24 PST
66+
67+
## v2.224.4 (2024-07-04)
68+
69+
### Bug Fixes and Other Changes
70+
71+
* allow for inf spec and server override to be passed
72+
73+
## v2.224.3 (2024-07-03)
74+
75+
### Bug Fixes and Other Changes
76+
77+
* Upgrade local dependencies
78+
* Improve docstrings for estimator tags
79+
380
## v2.224.2 (2024-06-27)
481

582
### Bug Fixes and Other Changes

‎MANIFEST.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ recursive-include requirements *
88
include VERSION
99
include LICENSE.txt
1010
include README.rst
11+
include hatch_build.py
1112

1213
prune tests
1314

‎VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.224.3.dev0
1+
2.228.1.dev0

‎hatch_build.py

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
from __future__ import absolute_import
2+
3+
import os
4+
import sys
5+
6+
from hatchling.metadata.plugin.interface import MetadataHookInterface
7+
8+
9+
class CustomMetadataHook(MetadataHookInterface):
10+
def update(self, metadata):
11+
metadata["optional-dependencies"] = get_optional_dependencies(self.root)
12+
13+
14+
def get_optional_dependencies(root):
15+
16+
def read_feature_deps(feature):
17+
req_file = os.path.join(root, "requirements", "extras", f"{feature}_requirements.txt")
18+
with open(req_file, encoding="utf-8") as f:
19+
return list(filter(lambda d: not d.startswith("#"), f.read().splitlines()))
20+
21+
optional_dependencies = {"all": []}
22+
23+
for feature in ("feature-processor", "huggingface", "local", "scipy"):
24+
dependencies = read_feature_deps(feature)
25+
optional_dependencies[feature] = dependencies
26+
optional_dependencies["all"].extend(dependencies)
27+
28+
# Test dependencies come last because we don't want them in `all`
29+
optional_dependencies["test"] = read_feature_deps("test")
30+
optional_dependencies["test"].extend(optional_dependencies["all"])
31+
32+
# remove torch and torchvision if python version is not 3.10/3.11
33+
if sys.version_info.minor not in (10, 11):
34+
optional_dependencies["test"] = list(
35+
filter(
36+
lambda d: not d.startswith(
37+
("sentencepiece", "transformers", "torch", "torchvision")
38+
),
39+
optional_dependencies["test"],
40+
)
41+
)
42+
43+
return optional_dependencies

‎pyproject.toml

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,90 @@
1+
[build-system]
2+
requires = ["hatchling"]
3+
build-backend = "hatchling.build"
4+
5+
[project]
6+
name = "sagemaker"
7+
dynamic = ["version", "optional-dependencies"]
8+
description = "Open source library for training and deploying models on Amazon SageMaker."
9+
readme = "README.rst"
10+
requires-python = ">=3.8"
11+
authors = [
12+
{ name = "Amazon Web Services" },
13+
]
14+
keywords = [
15+
"AI",
16+
"AWS",
17+
"Amazon",
18+
"ML",
19+
"MXNet",
20+
"Tensorflow",
21+
]
22+
classifiers = [
23+
"Development Status :: 5 - Production/Stable",
24+
"Intended Audience :: Developers",
25+
"License :: OSI Approved :: Apache Software License",
26+
"Natural Language :: English",
27+
"Programming Language :: Python",
28+
"Programming Language :: Python :: 3.8",
29+
"Programming Language :: Python :: 3.9",
30+
"Programming Language :: Python :: 3.10",
31+
"Programming Language :: Python :: 3.11",
32+
]
33+
dependencies = [
34+
"attrs>=23.1.0,<24",
35+
"boto3>=1.34.142,<2.0",
36+
"cloudpickle==2.2.1",
37+
"docker",
38+
"google-pasta",
39+
"importlib-metadata>=1.4.0,<7.0",
40+
"jsonschema",
41+
"numpy>=1.9.0,<2.0",
42+
"packaging>=20.0",
43+
"pandas",
44+
"pathos",
45+
"platformdirs",
46+
"protobuf>=3.12,<5.0",
47+
"psutil",
48+
"PyYAML~=6.0",
49+
"requests",
50+
"schema",
51+
"smdebug_rulesconfig==1.0.1",
52+
"tblib>=1.7.0,<4",
53+
"tqdm",
54+
"urllib3>=1.26.8,<3.0.0",
55+
]
56+
57+
[project.scripts]
58+
sagemaker-upgrade-v2 = "sagemaker.cli.compatibility.v2.sagemaker_upgrade_v2:main"
59+
60+
[project.urls]
61+
Homepage = "https://github.com/aws/sagemaker-python-sdk"
62+
63+
[tool.hatch.version]
64+
path = "VERSION"
65+
pattern = "(?P<version>.+)"
66+
67+
# Dynamically define optional dependencies from requirements.txt files so
68+
# they can be be tracked by Dependabot
69+
[tool.hatch.metadata.hooks.custom]
70+
71+
[tool.hatch.build.targets.wheel]
72+
packages = ["src/sagemaker"]
73+
exclude = ["src/sagemaker/serve/model_server/triton/pack_conda_env.sh"]
74+
75+
[tool.hatch.build.targets.wheel.shared-scripts]
76+
"src/sagemaker/serve/model_server/triton/pack_conda_env.sh" = "pack_conda_env.sh"
77+
78+
[tool.hatch.build.targets.sdist]
79+
only-include = [
80+
"/requirements/extras",
81+
"/src",
82+
"/VERSION",
83+
]
84+
85+
[tool.pytest.ini_options]
86+
addopts = ["-vv"]
87+
testpaths = ["tests"]
88+
189
[tool.black]
290
line-length = 100

‎requirements/extras/local_requirements.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
urllib3>=1.26.8,<3.0.0
2-
docker>=5.0.2,<7.0.0
2+
docker>=5.0.2,<8.0.0
33
PyYAML>=5.4.1,<7

0 commit comments

Comments
 (0)