ci: replace obsolete Windows image and fix permission issue with Docker container

.github/cloudbuild/flutter-windows.yaml

@@ -34,7 +34,7 @@ steps:
       - --region=$_CE_REGION
       - --zone=$_CE_ZONE
       - --machineType=$_CE_MACHINE_TYPE
-      - --image=windows-cloud/global/images/windows-server-2019-dc-for-containers-v20220414
+      - --image=projects/gce-uefi-images/global/images/windows-server-2019-dc-for-containers-v20200609
       # When using other disk types image pulling and image building could take up to 3 hours
       - --diskType=pd-ssd
       - --workspace-bucket=$_WORKSPACE_TMP_BUCKET

.github/workflows/code-analysis.yml

@@ -38,21 +38,23 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Check if base Dockerfile changed
-        id: changed-base
-        uses: tj-actions/changed-files@v35
+      - name: Check if Dockerfile changed
+        id: changed
+        uses: tj-actions/changed-files@v40
         with:
-          files: flutter/android/docker/Dockerfile
+          files: |
+            flutter/android/docker/Dockerfile
+            tools/scanner/Dockerfile
       - name: Extract metadata for base image
         id: meta-base
-        if: steps.changed-base.outputs.any_changed == 'true'
+        if: steps.changed.outputs.any_changed == 'true'
         uses: docker/metadata-action@v4
         with:
           images: ghcr.io/mlcommons/mobile_app_open-base
           flavor: latest=true
           tags: type=raw,value=${{ github.run_number }}
       - name: Build and push base image
-        if: steps.changed-base.outputs.any_changed == 'true'
+        if: steps.changed.outputs.any_changed == 'true'
         uses: docker/build-push-action@v4
         with:
           context: flutter/android/docker
@@ -62,20 +64,15 @@ jobs:
           labels: ${{ steps.meta-base.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-      - name: Check if scanner Dockerfile changed
-        id: changed-scanner
-        uses: tj-actions/changed-files@v35
-        with:
-          files: tools/scanner/Dockerfile
       - name: Extract metadata for scanner image
         id: meta-scanner
-        if: steps.changed-scanner.outputs.any_changed == 'true'
+        if: steps.changed.outputs.any_changed == 'true'
         uses: docker/metadata-action@v4
         with:
           images: ghcr.io/mlcommons/mobile_app_open-scanner
           flavor: latest=true
       - name: Build and push scanner image
-        if: steps.changed-scanner.outputs.any_changed == 'true'
+        if: steps.changed.outputs.any_changed == 'true'
         uses: docker/build-push-action@v4
         with:
           context: tools/scanner
@@ -86,7 +83,5 @@ jobs:
           labels: ${{ steps.meta-scanner.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-      - name: Build app
-        run: make docker/scanner/build-app
       - name: Scan code
         run: make docker/scanner/scan

flutter/android/android-docker.mk

@@ -14,12 +14,11 @@
 ##########################################################################
 
 DOCKER_IMAGE_TAG?=mlcommons/mlperf_mobile_flutter
-
-flutter_docker_postfix=$(shell id -u)
+user_id=$(shell id -u)
 
 .PHONY: flutter/android/docker/image
-flutter/android/docker/image: output/docker/mlperf_mobile_flutter_android_${flutter_docker_postfix}.stamp
-output/docker/mlperf_mobile_flutter_android_${flutter_docker_postfix}.stamp: flutter/android/docker/Dockerfile
+flutter/android/docker/image: output/docker/mlperf_mobile_flutter_android_${user_id}.stamp
+output/docker/mlperf_mobile_flutter_android_${user_id}.stamp: flutter/android/docker/Dockerfile
 	docker image build -t ${DOCKER_IMAGE_TAG} flutter/android/docker
 	mkdir -p output/docker
 	touch $@
@@ -33,19 +32,16 @@ flutter_common_docker_flags= \
 		--rm \
 		${flutter_docker_tty_arg} \
 		--init \
-		--user `id -u`:`id -g` \
-		--env USER=mlperf \
-		-v $(CURDIR):/mnt/project \
-		--workdir /mnt/project \
-		-v /mnt/project/flutter/build \
-		-v mlperf-mobile-flutter-cache-bazel-${flutter_docker_postfix}:/mnt/cache \
+		--workdir /image-workdir/project \
+		-v $(CURDIR):/image-workdir/project \
+		-v mlperf-mobile-flutter-cache-bazel-${user_id}:/image-workdir/cache/bazel \
+		--env BAZEL_CACHE_ARG="--disk_cache=/image-workdir/cache/bazel" \
 		--env WITH_TFLITE=${WITH_TFLITE} \
 		--env WITH_QTI=${WITH_QTI} \
 		--env WITH_SAMSUNG=${WITH_SAMSUNG} \
 		--env WITH_PIXEL=${WITH_PIXEL} \
 		--env WITH_MEDIATEK=${WITH_MEDIATEK} \
 		--env proxy_bazel_args=${proxy_bazel_args} \
-		--env BAZEL_OUTPUT_ROOT_ARG="--output_user_root=/mnt/cache/bazel" \
 		--env OFFICIAL_BUILD=${OFFICIAL_BUILD} \
 		--env FLUTTER_BUILD_NUMBER=${FLUTTER_BUILD_NUMBER} \
 		--env FLUTTER_FORCE_PUB_GET=1 \

flutter/android/docker/Dockerfile

@@ -60,17 +60,13 @@ RUN flutter config --no-analytics && dart --disable-analytics
 RUN flutter doctor -v
 RUN dart pub global activate protoc_plugin ^20.0.1 && chmod --recursive a=u $PUB_CACHE
 
-RUN mkdir -p $HOME/.cache/ && chmod 777 $HOME/.cache/
-RUN mkdir -p $HOME/.cache/.gradle && chmod 777 $HOME/.cache/.gradle
+RUN mkdir -p $HOME/.cache/.gradle
 ENV GRADLE_USER_HOME=$HOME/.cache/.gradle
 ENV ANDROID_SDK_HOME=$HOME/.cache/.android
 
-RUN mkdir $ANDROID_SDK_HOME && chmod 777 $HOME/.cache/.android && \
+RUN mkdir $ANDROID_SDK_HOME && \
     PASSWD=$(pwgen -s -y 20 1) && keytool -genkey -v -keystore $ANDROID_SDK_HOME/debug.keystore \
     -storepass $PASSWD -alias androiddebugkey -keypass $PASSWD -dname "CN=Android Debug,O=Android,C=US"
 
-RUN chmod -R 754 $HOME
-
-RUN mkdir -p /mnt/cache && chmod 777 /mnt/cache
-RUN mkdir -p /mnt/project/flutter/build && chmod 777 /mnt/project/flutter/build
-RUN mkdir -p $HOME/.cache/bazelisk && chmod 777 $HOME/.cache/bazelisk
+# Git repo will be mounted at '/image-workdir/project'
+RUN git config --global --add safe.directory /image-workdir/project

flutter/integration_test/expected_throughput.dart

@@ -30,12 +30,12 @@ const Map<String, Map<String, Interval>> _imageClassification = {
     _kCloudBuildX23: Interval(min: 4, max: 12),
     _kCloudBuildX28: Interval(min: 4, max: 13),
     _kRyzen5600: Interval(min: 31, max: 37),
-    _kPixel5: Interval(min: 80, max: 120),
-    _kIphoneOnGitHubAction: Interval(min: 2, max: 7),
+    _kPixel5: Interval(min: 80, max: 130),
+    _kIphoneOnGitHubAction: Interval(min: 2, max: 8),
     _kIphoneOnMacbookM1: Interval(min: 19, max: 27),
   },
   _kCoreMLBackend: {
-    _kIphoneOnGitHubAction: Interval(min: 2, max: 7),
+    _kIphoneOnGitHubAction: Interval(min: 2, max: 8),
   },
   _kPixelBackend: {
     _kPixel6: Interval(min: 800, max: 1100),
@@ -47,12 +47,12 @@ const Map<String, Map<String, Interval>> _objectDetection = {
     _kCloudBuildX23: Interval(min: 4, max: 7),
     _kCloudBuildX28: Interval(min: 3.5, max: 8),
     _kRyzen5600: Interval(min: 14, max: 22),
-    _kPixel5: Interval(min: 40, max: 55),
-    _kIphoneOnGitHubAction: Interval(min: 2, max: 7),
+    _kPixel5: Interval(min: 40, max: 60),
+    _kIphoneOnGitHubAction: Interval(min: 1.5, max: 4),
     _kIphoneOnMacbookM1: Interval(min: 9, max: 16),
   },
   _kCoreMLBackend: {
-    _kIphoneOnGitHubAction: Interval(min: 2, max: 7),
+    _kIphoneOnGitHubAction: Interval(min: 1.5, max: 4),
   },
   _kPixelBackend: {
     _kPixel6: Interval(min: 300, max: 490),
@@ -64,12 +64,12 @@ const Map<String, Map<String, Interval>> _imageSegmentation = {
     _kCloudBuildX23: Interval(min: 0.5, max: 3),
     _kCloudBuildX28: Interval(min: 0.5, max: 4),
     _kRyzen5600: Interval(min: 5, max: 7),
-    _kPixel5: Interval(min: 25, max: 35),
-    _kIphoneOnGitHubAction: Interval(min: 0.5, max: 2),
+    _kPixel5: Interval(min: 25, max: 40),
+    _kIphoneOnGitHubAction: Interval(min: 0.5, max: 2.5),
     _kIphoneOnMacbookM1: Interval(min: 3, max: 6),
   },
   _kCoreMLBackend: {
-    _kIphoneOnGitHubAction: Interval(min: 0.5, max: 2),
+    _kIphoneOnGitHubAction: Interval(min: 0.5, max: 2.5),
   },
   _kPixelBackend: {
     _kPixel6: Interval(min: 100, max: 180),
@@ -81,12 +81,12 @@ const Map<String, Map<String, Interval>> _naturalLanguageProcessing = {
     _kCloudBuildX23: Interval(min: 0.7, max: 1.1),
     _kCloudBuildX28: Interval(min: 0.5, max: 1.3),
     _kRyzen5600: Interval(min: 2.8, max: 3.2),
-    _kPixel5: Interval(min: 2.3, max: 2.7),
-    _kIphoneOnGitHubAction: Interval(min: 0.4, max: 1),
+    _kPixel5: Interval(min: 2.3, max: 3.0),
+    _kIphoneOnGitHubAction: Interval(min: 0.3, max: 1),
     _kIphoneOnMacbookM1: Interval(min: 1.8, max: 3),
   },
   _kCoreMLBackend: {
-    _kIphoneOnGitHubAction: Interval(min: 0.4, max: 1),
+    _kIphoneOnGitHubAction: Interval(min: 0.3, max: 1),
   },
   _kPixelBackend: {
     // pixel some time finish this task in 4 seconds, not sure why.
@@ -99,7 +99,7 @@ const Map<String, Map<String, Interval>> _imageClassificationOffline = {
     _kCloudBuildX23: Interval(min: 8, max: 14),
     _kCloudBuildX28: Interval(min: 7, max: 16),
     _kRyzen5600: Interval(min: 45, max: 60),
-    _kPixel5: Interval(min: 120, max: 180),
+    _kPixel5: Interval(min: 120, max: 190),
     _kIphoneOnGitHubAction: Interval(min: 3, max: 15),
     _kIphoneOnMacbookM1: Interval(min: 30, max: 45),
   },
@@ -117,7 +117,7 @@ const Map<String, Map<String, Interval>> _superResolution = {
     _kCloudBuildX23: Interval(min: 0.1, max: 3),
     _kCloudBuildX28: Interval(min: 0.1, max: 4),
     _kRyzen5600: Interval(min: 0.1, max: 3),
-    _kPixel5: Interval(min: 4, max: 7),
+    _kPixel5: Interval(min: 4, max: 8),
     _kIphoneOnGitHubAction: Interval(min: 0.1, max: 3),
     _kIphoneOnMacbookM1: Interval(min: 0.1, max: 10),
   },

tools/scanner/Dockerfile

@@ -26,6 +26,16 @@ RUN chmod -R 777 $SONAR_SCANNER_DIR
 
 # Install Node.js and NPM for JS analysis
 ENV NODE_ENV="production"
-RUN curl --proto '=https' -fsSL https://deb.nodesource.com/setup_lts.x | bash -
-RUN apt-get update && apt-get install -y --no-install-recommends nodejs && node -v
-RUN npm install --ignore-scripts --location=global [email protected] && npm --version
+RUN set -uex; \
+    apt-get update >/dev/null; \
+    apt-get install -y --no-install-recommends ca-certificates curl gnupg; \
+    apt-get clean; \
+    mkdir -p /etc/apt/keyrings; \
+    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
+     | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg; \
+    NODE_MAJOR=18; \
+    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" \
+     > /etc/apt/sources.list.d/nodesource.list; \
+    apt-get update >/dev/null; \
+    apt-get install -y --no-install-recommends nodejs; \
+    rm -rf /var/lib/apt/lists/*

tools/scanner/scan.mk

@@ -51,7 +51,7 @@ scanner/build-app:
 		make flutter/android
 
 .PHONY: scanner/scan
-scanner/scan:
+scanner/scan: scanner/build-app
 	sonar-scanner \
 		-Dsonar.organization=mlcommons \
 		-Dsonar.projectKey=mlcommons_mobile_app_open \
@@ -71,12 +71,6 @@ scanner/scan:
 		-Dsonar.pullrequest.branch=${PR_BRANCH} \
 		-Dsonar.pullrequest.base=${PR_BASE}
 
-.PHONY: docker/scanner/build-app
-docker/scanner/build-app:
-	MSYS2_ARG_CONV_EXCL="*" docker run \
-		${scanner_docker_args} ${flutter_common_docker_flags} \
-		make scanner/build-app
-
 .PHONY: docker/scanner/scan
 docker/scanner/scan:
 	MSYS2_ARG_CONV_EXCL="*" docker run \