Repository navigation
[CI] Use HF Trusted Publisher OIDC tokens - #15106
Conversation
sayakpaul
left a comment
sayakpaul
left a comment
There was a problem hiding this comment.
Thanks! Could we maybe also trigger a CI and see successful runs before merging?
|
|
||
| env: | ||
| HF_TOKEN: ${{ secrets.DIFFUSERS_HF_HUB_READ_TOKEN }} | ||
| HF_OIDC_RESOURCE: ${{ !github.event.pull_request.head.repo.fork && 'Diffusers-CI-Bot' || '' }} |
There was a problem hiding this comment.
What is happening here? 👀
Because in some places I am seeing:
HF_OIDC_RESOURCE: Diffusers-CI-Bot
There was a problem hiding this comment.
PRs from forks do not have secrets injected into the env. This also applies to OIDC tokens. So if the OIDC resource is set to Diffusers-CI-Bot and no corresponding token is available, the Hub requests raises an OIDCError.
This section just sets the HF_OIDC_RESOURCE to an empty string, which would then set the HF token to None in the subsequent workflows, which is the current behaviour for forked PRs.
|
Could we maybe also trigger a CI and see successful runs before merging? |
|
@sayakpaul CI is passing. |
What does this PR do?
Following #15096. It would be better to just replace all instances of bot tokens with OIDC tokens.
Fixes # (issue)
Before submitting
self-reviewskill on the diff?documentation guidelines, and
here are tips on formatting docstrings.
Who can review?
Anyone in the community is free to review the PR once the tests have passed. Feel free to tag
members/contributors who may be interested in your PR.