Merge branch 'master' into squeeze_v15_reverse_infer

.github/actions/handle_docker/action.yml

@@ -27,25 +27,28 @@ runs:
   using: 'composite'
   steps:
     - name: Checkout head
-      uses: actions/checkout@v4
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
     - name: Checkout base
-      uses: actions/checkout@v4
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       with:
         ref: ${{ github.base_ref || github.event.merge_group.base_ref }}
         sparse-checkout: ${{ inputs.dockerfiles_root_dir }}/docker_tag
         path: base
 
     - name: Install Python dependencies
-      uses: py-actions/py-dependency-install@v4
+      uses: py-actions/py-dependency-install@30aa0023464ed4b5b116bd9fbdab87acf01a484e # v4.1.0
       with:
         path: "${{ github.action_path }}/requirements.txt"
         update-setuptools: "false"
         update-wheel: "false"
 
     - name: Set up Docker Buildx
       id: buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
+      with:
+        driver-opts: |
+          image=${{ inputs.registry }}/dockerio/moby/buildkit:buildx-stable-1
 
     - name: Handle docker images
       id: handle_images
@@ -62,7 +65,7 @@ runs:
         --base_tag_file "base/${{ inputs.dockerfiles_root_dir }}/docker_tag" \
         --docker_env_changed "${{ fromJSON(inputs.changed_components).docker_env }}" \
         --dockerfiles_changed "${{ fromJSON(inputs.changed_components).dockerfiles }}" \
-        --docker_builder "${{ steps.buildx.outputs.name}}" \
+        --docker_builder "${{ steps.buildx.outputs.name }}" \
         --repo "${{ github.repository }}" \
         --ref_name "${{ github.ref_name }}" \
         $([[ -n $pr ]] && echo "--pr $pr" || echo '-s ${{ github.sha }}') \

.github/actions/setup_python/action.yml

@@ -56,13 +56,13 @@ runs:
 
     - if: ${{ runner.os == 'macOS' || runner.os == 'Windows' || (runner.os == 'Linux' && runner.arch != 'ARM64' && steps.check_python.outputs.installed == 'false' ) }}
       name: Setup Python ${{ inputs.version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
       with:
         python-version: ${{ inputs.version }}
       env:
         PIP_CACHE_DIR: ${{ inputs.self-hosted-runner == 'true' && inputs.pip-cache-path || '' }}
 
-    - if: ${{ inputs.should-setup-pip-paths == 'true' }}
+    - if: ${{ inputs.should-setup-pip-paths == 'true' && runner.os != 'Windows' }}
       name: Setup pip variables (cache and install path)
       shell: bash
       run: |
@@ -71,6 +71,14 @@ runs:
         echo "PIP_CACHE_DIR=${{ inputs.pip-cache-path }}/${PIP_VER}" >> $GITHUB_ENV
         echo "PIP_INSTALL_PATH=$(python3 -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')" >> $GITHUB_ENV
 
+    - if: ${{ inputs.should-setup-pip-paths == 'true' && runner.os == 'Windows' }}
+      name: Setup pip cache path
+      shell: pwsh
+      run: |
+        $pipVersion = python3 -c "import pip; print(pip.__version__)"
+        Write-Host "Using pip version: $pipVersion"
+        "PIP_CACHE_DIR=${{ inputs.pip-cache-path }}/$pipVersion" >> $env:GITHUB_ENV
+
     - if: ${{ inputs.show-cache-info == 'true' }}
       name: Get pip cache info
       shell: bash

.github/actions/smart-ci/action.yml

@@ -65,7 +65,7 @@ runs:
   using: "composite"
   steps:
     - name: Wait for labeler to finish
-      uses: lewagon/[email protected].1
+      uses: lewagon/wait-on-check-action@ccfb013c15c8afb7bf2b7c028fb74dc5a068cccc # v1.3.4
       if: ${{ github.event_name == 'pull_request' }}
       with:
         ref: ${{ github.event.pull_request.head.sha }}
@@ -74,13 +74,13 @@ runs:
         wait-interval: 10
 
     - name: checkout components file
-      uses: actions/checkout@v4
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       with:
         sparse-checkout: .github/components.yml
         sparse-checkout-cone-mode: false
 
     - name: Install Python dependencies
-      uses: py-actions/py-dependency-install@v4
+      uses: py-actions/py-dependency-install@30aa0023464ed4b5b116bd9fbdab87acf01a484e # v4.1.0
       with:
         path: "${{ github.action_path }}/requirements.txt"
         update-setuptools: "false"

.github/dependency_review.yml

@@ -2,13 +2,10 @@ fail-on-severity: 'low'
 allow-licenses:
   - 'BSD-2-Clause'
   - 'BSD-3-Clause'
-  - 'BSD-2-Clause AND BSD-3-Clause'
-  - 'BSD-3-Clause AND BSD-3-Clause-Clear'
+  - 'BSD-3-Clause-Clear'
   - 'MIT'
   - 'Apache-2.0'
-  - 'Apache-2.0 AND BSD-3-Clause'
   - 'ISC'
-  - 'Apache-2.0 AND MIT'
   - 'BlueOak-1.0.0'
   - '0BSD'
   - 'Python-2.0'

.github/dockerfiles/docker_tag

@@ -1 +1 @@
-pr-26993
+pr-27384

.github/workflows/android_arm64.yml

@@ -169,7 +169,7 @@ jobs:
         run: ${SCCACHE_PATH} --zero-stats
 
       - name: Cmake - build
-        run: cmake --build ${BUILD_DIR} --parallel
+        run: cmake --build ${BUILD_DIR} --parallel $(nproc)
 
       - name: Show ccache stats
         run: ${SCCACHE_PATH} --show-stats

.github/workflows/android_x64.yml

@@ -144,7 +144,7 @@ jobs:
         run: ${SCCACHE_PATH} --zero-stats
 
       - name: Cmake - build
-        run: cmake --build ${BUILD_DIR} --parallel
+        run: cmake --build ${BUILD_DIR} --parallel $(nproc)
 
       - name: Show ccache stats
         run: ${SCCACHE_PATH} --show-stats

.github/workflows/coverage.yml

@@ -138,6 +138,6 @@ jobs:
           lcov --capture --directory ${{ github.workspace }}/. --output-file coverage.info
           genhtml coverage.info --output-directory coverage-report
       - name: Collect coverage
-        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
         with:
           verbose: true

.github/workflows/coverity.yml

@@ -25,15 +25,66 @@ env:
   TARGET_BRANCH: ${{ github.base_ref || github.event.merge_group.base_ref || github.ref }}
 
 jobs:
+
+  Smart_CI:
+    runs-on: ubuntu-latest
+    outputs:
+      affected_components: "${{ steps.smart_ci.outputs.affected_components }}"
+      changed_components: "${{ steps.smart_ci.outputs.changed_components }}"
+      skip_workflow: "${{ steps.smart_ci.outputs.skip_workflow }}"
+    steps:
+      - name: checkout action
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          sparse-checkout: .github/actions/smart-ci
+
+      - name: Get affected components
+        id: smart_ci
+        uses: ./.github/actions/smart-ci
+        with:
+          repository: ${{ github.repository }}
+          pr: ${{ github.event.number }}
+          commit_sha: ${{ github.sha }}
+          ref_name: ${{ github.ref_name }}
+          component_pattern: "category: (.*)"
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          skip_when_only_listed_labels_set: 'docs'
+          skip_when_only_listed_files_changed: '*.md,*.rst,*.png,*.jpg,*.svg'
+
+  Docker:
+    needs: Smart_CI
+    runs-on: aks-linux-4-cores-16gb-docker-build
+    container:
+      image: openvinogithubactions.azurecr.io/docker_build:0.2
+      volumes:
+        - /mount:/mount
+    outputs:
+      images: "${{ steps.handle_docker.outputs.images }}"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: ./.github/actions/handle_docker
+        id: handle_docker
+        with:
+          images: |
+            ov_build/ubuntu_20_04_x64
+          registry: 'openvinogithubactions.azurecr.io'
+          dockerfiles_root_dir: '.github/dockerfiles'
+          changed_components: ${{ needs.smart_ci.outputs.changed_components }}
+
   Build:
+    needs: Docker
     timeout-minutes: 150
     defaults:
       run:
         shell: bash
     runs-on: aks-linux-16-cores-32gb
     if: ${{ github.repository_owner == 'openvinotoolkit' }}
     container:
-      image: openvinogithubactions.azurecr.io/dockerhub/ubuntu:20.04
+      image: ${{ fromJSON(needs.docker.outputs.images).ov_build.ubuntu_20_04_x64 }}
+      volumes:
+        - /mount:/mount
     env:
       DEBIAN_FRONTEND: noninteractive # to prevent apt-get from waiting user input
       CMAKE_BUILD_TYPE: 'Release'
@@ -45,11 +96,6 @@ jobs:
       COVERITY_TOOL_DIR: /__w/openvino/openvino/coverity_tool
 
     steps:
-      - name: Install git
-        run: |
-          apt-get update
-          apt-get install --assume-yes --no-install-recommends git ca-certificates
-
       - name: Clone OpenVINO
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -86,7 +132,7 @@ jobs:
       #
       # Build
       #
-
+        
       - name: CMake configure - OpenVINO
         run: |
           cmake \
@@ -107,13 +153,11 @@ jobs:
           popd
 
       - name: Cmake build - OpenVINO with Coverity
-        run: ${COVERITY_TOOL_DIR}/cov-analysis*/bin/cov-build --dir ${BUILD_DIR}/cov-int cmake --build ${BUILD_DIR} --parallel --config ${{ env.CMAKE_BUILD_TYPE }}
+        run: ${COVERITY_TOOL_DIR}/cov-analysis*/bin/cov-build --dir ${BUILD_DIR}/cov-int cmake --build ${BUILD_DIR} --parallel $(nproc) --config ${{ env.CMAKE_BUILD_TYPE }}
 
       - name: Pack Artefacts
-        run: |
-          pushd ${BUILD_DIR}
-            tar -cvf - cov-int | pigz > openvino.tgz
-          popd
+        run: tar -cvf - cov-int | pigz > openvino.tgz
+        working-directory: ${{ env.BUILD_DIR }}
 
       - name: Submit artefacts
         run: |

.github/workflows/dev_cpu_linux_snippets_libxsmm.yml

@@ -143,7 +143,7 @@ jobs:
         run: ${SCCACHE_PATH} --zero-stats
 
       - name: Cmake build - OpenVINO
-        run: cmake --build ${BUILD_DIR} --parallel --config ${{ env.CMAKE_BUILD_TYPE }}
+        run: cmake --build ${BUILD_DIR} --parallel $(nproc) --config ${{ env.CMAKE_BUILD_TYPE }}
 
       - name: Show sccache stats
         run: ${SCCACHE_PATH} --show-stats

.github/workflows/fedora_29.yml

@@ -5,7 +5,7 @@ on:
   merge_group:
   push:
     branches:
-      # - master
+      - master
       - 'releases/**'
 
 concurrency:

.github/workflows/job_build_linux.yml

@@ -168,7 +168,7 @@ jobs:
         run: ${SCCACHE_PATH} --zero-stats
 
       - name: Cmake build - OpenVINO
-        run: cmake --build ${BUILD_DIR} --parallel --config ${{ env.CMAKE_BUILD_TYPE }}
+        run: cmake --build ${BUILD_DIR} --parallel $(nproc) --config ${{ env.CMAKE_BUILD_TYPE }}
 
       - name: Show sccache stats
         run: ${SCCACHE_PATH} --show-stats
@@ -210,7 +210,7 @@ jobs:
                 -DPython3_EXECUTABLE=$python_exec \
                 -DCPACK_GENERATOR=DEB \
                 ${BUILD_DIR}
-          cmake --build ${BUILD_DIR} --parallel --config ${{ env.CMAKE_BUILD_TYPE }} --target package
+          cmake --build ${BUILD_DIR} --parallel $(nproc) --config ${{ env.CMAKE_BUILD_TYPE }} --target package
 
       - name: Cmake & Build - OpenVINO Contrib
         if: ${{ inputs.build-contrib }}
@@ -221,7 +221,7 @@ jobs:
             -DENABLE_WHEEL=OFF \
             -S ${OPENVINO_REPO} \
             -B ${BUILD_DIR}
-          cmake --build ${BUILD_DIR} --parallel --config ${{ env.CMAKE_BUILD_TYPE }}
+          cmake --build ${BUILD_DIR} --parallel $(nproc) --config ${{ env.CMAKE_BUILD_TYPE }}
 
       - name: CMake configure, build and install - OpenVINO JS API
         if: ${{ fromJSON(inputs.affected-components).JS_API && inputs.build-js }}
@@ -230,7 +230,7 @@ jobs:
                 -DCPACK_GENERATOR=NPM \
                 -DENABLE_SYSTEM_TBB=OFF \
                 -DENABLE_WHEEL=OFF
-          cmake --build ${BUILD_DIR} --parallel
+          cmake --build ${BUILD_DIR} --parallel $(nproc)
           cmake --install ${BUILD_DIR} --prefix ${INSTALL_DIR_JS}
 
       - name: Build RPM packages
@@ -243,7 +243,7 @@ jobs:
                 -DENABLE_WHEEL=OFF \
                 -DENABLE_TESTS=OFF \
                 ${BUILD_DIR}
-          cmake --build ${BUILD_DIR} --parallel --target package --verbose
+          cmake --build ${BUILD_DIR} --parallel $(nproc) --target package --verbose
 
       #
       # Upload build artifacts and logs

.github/workflows/job_build_windows.yml

@@ -25,7 +25,7 @@ on:
 permissions: read-all
 
 env:
-  PIP_CACHE_PATH: /mount/caches/pip/win
+  PIP_CACHE_PATH: "C:\\mount\\caches\\pip\\win"
   PYTHON_VERSION: '3.11'
 
 jobs:
@@ -164,7 +164,7 @@ jobs:
         run: '& ccache --zero-stats'
 
       - name: Cmake build - OpenVINO
-        run: cmake --build ${{ env.BUILD_DIR }} --config ${{ env.CMAKE_BUILD_TYPE }} --parallel --verbose
+        run: cmake --build ${{ env.BUILD_DIR }} --config ${{ env.CMAKE_BUILD_TYPE }} --parallel $ENV:NUMBER_OF_PROCESSORS --verbose
 
       - name: Show ccache stats
         run: '& ccache --show-stats'
@@ -201,7 +201,7 @@ jobs:
                 -DCPACK_GENERATOR=NPM `
                 -DENABLE_SYSTEM_TBB=OFF `
                 -DENABLE_WHEEL=OFF
-          cmake --build ${{ env.BUILD_DIR }} --parallel
+          cmake --build ${{ env.BUILD_DIR }} --parallel $ENV:NUMBER_OF_PROCESSORS
           cmake --install ${{ env.BUILD_DIR }} --config ${{ env.CMAKE_BUILD_TYPE }} --prefix ${{ env.INSTALL_DIR_JS }}
 
       #

.github/workflows/job_debian_packages.yml

@@ -50,14 +50,14 @@ jobs:
             # Install debian packages from previous release
             apt-get install --no-install-recommends -y gnupg wget ca-certificates lsb-release
             wget https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB
-            apt-key add GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB
-            
+            gpg --output /etc/apt/trusted.gpg.d/intel.gpg --dearmor GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB
+
             # Yields only the number, e.g., "20"
             ubuntu_version=$(lsb_release -r -s)
             ubuntu_version=${ubuntu_version%.*}
-            
+
             echo "deb https://apt.repos.intel.com/openvino/2024 ubuntu$ubuntu_version main" | tee /etc/apt/sources.list.d/intel-openvino-2024.list
-            
+
             apt-get update -y
             apt-get install -y openvino
           fi

.github/workflows/job_onnx_runtime.yml

@@ -96,7 +96,7 @@ jobs:
             --config RelWithDebInfo \
             --use_openvino CPU \
             --build_shared_lib \
-            --parallel \
+            --parallel $(nproc) \
             --skip_tests \
             --compile_no_warning_as_error \
             --allow_running_as_root \

.github/workflows/job_python_unit_tests.yml

@@ -111,10 +111,7 @@ jobs:
         run: |
           # To enable pytest parallel features
           python3 -m pip install pytest-xdist[psutil]
-          # For torchvision to OpenVINO preprocessing converter
-          python3 -m pip install -r ${INSTALL_TEST_DIR}/python/preprocess/torchvision/requirements.txt
-
-          # TODO: replace with Python API tests requirements
+          python3 -m pip install -r ${INSTALL_TEST_DIR}/bindings/python/requirements_test.txt
           python3 -m pip install -r ${INSTALL_TEST_DIR}/mo/requirements_dev.txt
 
       #
@@ -158,6 +155,9 @@ jobs:
 
       - name: Install Python Layer tests dependencies
         run: |
+          # For torchvision to OpenVINO preprocessing converter
+          python3 -m pip install -r ${INSTALL_TEST_DIR}/python/preprocess/torchvision/requirements.txt
+
           # layer test requirements
           python3 -m pip install -r ${LAYER_TESTS_INSTALL_DIR}/requirements.txt
 
@@ -267,7 +267,7 @@ jobs:
         if: ${{ fromJSON(inputs.affected-components).Python_API.test }}
         run: |
           python3 -m pip uninstall -y numpy
-          python3 -m pip install "numpy>=2.0.0,<2.1.0"
+          python3 -m pip install "numpy>=2.0.0,<2.2.0"
           python3 -m pip install -r ${INSTALL_TEST_DIR}/bindings/python/requirements_test.txt
           # for 'template' extension
           export LD_LIBRARY_PATH=${INSTALL_TEST_DIR}:$LD_LIBRARY_PATH