Conversation
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Pull request overview
This PR adds support for CPU and Metal (MPS) transformers backends to the LocalAI build system. The changes enable building transformer-based backends for macOS (Metal/MPS acceleration) and CPU-only environments, expanding platform support beyond the existing CUDA, Intel, and ROCm backends.
- Adds new
requirements-mps.txtfor MPS/Metal backend dependencies - Updates backend registry (
index.yaml) with CPU and Metal transformer backend configurations - Adds GitHub workflow jobs for building CPU and Metal transformer backends
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| backend/python/transformers/requirements-mps.txt | New requirements file defining Python dependencies for Metal/MPS backend |
| backend/python/transformers/requirements-cpu.txt | Adds PyTorch CPU index URL for CPU-only installations |
| backend/index.yaml | Registers new CPU and Metal transformer backend variants with container URIs and mappings |
| .github/workflows/backend.yml | Adds CI jobs for building CPU transformers backend (Linux) and Metal transformers backend (macOS) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| accelerate | ||
| llvmlite==0.43.0 | ||
| numba==0.60.0 | ||
| transformers | ||
| bitsandbytes | ||
| outetts |
There was a problem hiding this comment.
This requirements file installs several third-party packages (accelerate, transformers, bitsandbytes, outetts) without any version pinning, which creates a supply chain risk because each build or deployment will pull the latest code from the package index. If any of these packages or their upstream distribution channel is compromised, an attacker can ship a malicious update that will be automatically installed and executed in your backend environment. To reduce this risk, pin each of these dependencies to vetted versions (or immutable hashes) and manage upgrades explicitly through your dependency management process.
Description
This PR fixes #
Notes for Reviewers
Signed commits