Merge pull request #1600 from franz/workflow2

more GH workflow fixes

.github/workflows/scorecard.yml

@@ -69,6 +69,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea
         with:
           sarif_file: results.sarif

tools/docker/ArchLinux/default.dockerfile

-FROM library/archlinux:latest
+FROM library/archlinux:latest@sha256:c8501ab8b970205491501ba01d9bce9a04d70537fc15596360f1ce1011b08569
 ARG GIT_COMMIT=main
 LABEL git-commit=$GIT_COMMIT vendor=pocl distro=Arch version=1.0
 

tools/docker/ArchLinux/distro.dockerfile

-FROM library/archlinux:latest
+FROM library/archlinux:latest@sha256:c8501ab8b970205491501ba01d9bce9a04d70537fc15596360f1ce1011b08569
 ARG GIT_COMMIT=main
 LABEL git-commit=$GIT_COMMIT vendor=pocl distro=Arch version=1.0
 

tools/docker/Ubuntu/22_04.dockerfile

-FROM amd64/ubuntu:22.04
+FROM amd64/ubuntu:22.04@sha256:3d1556a8a18cf5307b121e0a98e93f1ddf1f3f8e092f1fddfd941254785b95d7
 
 ARG GIT_COMMIT=main
 ARG GH_PR
@@ -11,6 +11,10 @@ ENV TERM=dumb
 ENV TZ=Etc/UTC
 ENV DEBIAN_FRONTEND=noninteractive
 
+# these are only necessary for 22.04 to upgrade ocl-icd to 2.3.x (which supports OpenCL 3.0)
+COPY ocl-icd-ubuntu-ppa.list /etc/apt/sources.list.d/
+COPY ocl-icd_ubuntu_ppa.gpg /etc/apt/trusted.gpg.d/
+
 RUN apt update
 RUN apt upgrade -y
 

tools/docker/Ubuntu/24_04.dockerfile

-FROM amd64/ubuntu:24.04
+FROM amd64/ubuntu:24.04@sha256:74f92a6b3589aa5cac6028719aaac83de4037bad4371ae79ba362834389035aa
 
 ARG GIT_COMMIT=main
 ARG GH_PR

tools/docker/Ubuntu/conformance.dockerfile

-###################
-
-FROM amd64/ubuntu:22.04
+FROM amd64/ubuntu:24.04@sha256:74f92a6b3589aa5cac6028719aaac83de4037bad4371ae79ba362834389035aa
 
 ARG GIT_COMMIT=main
 ARG GH_PR
 ARG GH_SLUG=pocl/pocl
-ARG LLVM_VERSION=14
+ARG LLVM_VERSION=17
 
 LABEL git-commit=$GIT_COMMIT vendor=pocl distro=Ubuntu version=1.0
 
@@ -13,15 +11,11 @@ ENV TERM=dumb
 ENV TZ=Etc/UTC
 ENV DEBIAN_FRONTEND=noninteractive
 
-COPY ocl-icd-ubuntu-ppa.list /etc/apt/sources.list.d/
-COPY ocl-icd_ubuntu_ppa.gpg /etc/apt/trusted.gpg.d/
-
 RUN apt update
 RUN apt upgrade -y
 
 RUN apt install -y tzdata
-RUN apt install -y build-essential cmake git pkg-config libclang-${LLVM_VERSION}-dev clang-${LLVM_VERSION} libclang-cpp${LLVM_VERSION}-dev llvm-${LLVM_VERSION}-dev make ninja-build ocl-icd-libopencl1 ocl-icd-dev libhwloc-dev zlib1g zlib1g-dev  dialog apt-utils
-RUN ln -s /usr/lib/x86_64-linux-gnu/libOpenCL.so.1 /usr/lib/x86_64-linux-gnu/libOpenCL.so
+RUN apt install -y build-essential cmake git pkg-config libclang-${LLVM_VERSION}-dev clang-${LLVM_VERSION} libclang-cpp${LLVM_VERSION}-dev llvm-${LLVM_VERSION}-dev libllvmspirvlib-${LLVM_VERSION}-dev make ninja-build ocl-icd-libopencl1 ocl-icd-dev libhwloc-dev zlib1g zlib1g-dev  dialog apt-utils
 
 RUN cd /home ; git clone https://github.com/$GH_SLUG.git ; cd /home/pocl ; git checkout $GIT_COMMIT
 RUN cd /home/pocl ; test -z "$GH_PR" || (git fetch origin +refs/pull/$GH_PR/merge && git checkout -qf FETCH_HEAD) && :

tools/docker/Ubuntu/distro.dockerfile

-FROM amd64/ubuntu:22.04
+FROM amd64/ubuntu:24.04@sha256:74f92a6b3589aa5cac6028719aaac83de4037bad4371ae79ba362834389035aa
 
 ARG GIT_COMMIT=main
 ARG GH_PR
 ARG GH_SLUG=pocl/pocl
-ARG LLVM_VERSION=13
+ARG LLVM_VERSION=17
 
 LABEL git-commit=$GIT_COMMIT vendor=pocl distro=Ubuntu version=1.0