Skip to content

[CI] Use HF Trusted Publisher OIDC tokens - #15106

Open
DN6 wants to merge 1 commit into
mainfrom
ci-oidc-tokens
Open

DN6 wants to merge 1 commit into
mainfrom
ci-oidc-tokens

Conversation

@DN6

@DN6 DN6 commented Oct 22, 2026

Copy link
Copy Markdown
Collaborator

What does this PR do?

Following #15096. It would be better to just replace all instances of bot tokens with OIDC tokens.

Fixes # (issue)

Before submitting

  • Did you use an AI agent (Claude Code, Codex, Cursor, etc.) to help with this PR? If so:
    • Did you read the Coding with AI agents guide?
    • Did you run the self-review skill on the diff?
    • Did you share the final self-review notes in the PR description or a comment?
  • Did you read the contributor guideline?
  • Did you read our philosophy doc? (important for complex PRs)
  • Was this discussed/approved via a GitHub issue or the forum? Please add a link to it if that's the case.
  • Did you make sure to update the documentation with your changes? Here are the
    documentation guidelines, and
    here are tips on formatting docstrings.
  • Did you write any new necessary tests?
  • Are you the author (or part of the team) of the model/pipeline (only applicable for model/pipeline related PRs)?

Who can review?

Anyone in the community is free to review the PR once the tests have passed. Feel free to tag
members/contributors who may be interested in your PR.

@DN6
DN6 marked this pull request as ready for review October 22, 2026 11:20
@github-actions github-actions Bot added CI size/M PR with diff < 200 LOC labels Oct 22, 2026
@DN6
DN6 requested a review from sayakpaul October 22, 2026 11:47

@sayakpaul sayakpaul left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Could we maybe also trigger a CI and see successful runs before merging?


env:
HF_TOKEN: ${{ secrets.DIFFUSERS_HF_HUB_READ_TOKEN }}
HF_OIDC_RESOURCE: ${{ !github.event.pull_request.head.repo.fork && 'Diffusers-CI-Bot' || '' }}

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is happening here? 👀

Because in some places I am seeing:

HF_OIDC_RESOURCE: Diffusers-CI-Bot

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PRs from forks do not have secrets injected into the env. This also applies to OIDC tokens. So if the OIDC resource is set to Diffusers-CI-Bot and no corresponding token is available, the Hub requests raises an OIDCError.

This section just sets the HF_OIDC_RESOURCE to an empty string, which would then set the HF token to None in the subsequent workflows, which is the current behaviour for forked PRs.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CI size/M PR with diff < 200 LOC

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants