ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tests: pin the amd/huggingfacenotorch extras and name the audit failure

Browse source 
security-audit.yml builds its hf-stack scan set by indexing
[huggingfacenotorch] out of pyproject.toml with no guard. The pip release
branch never had that extra, so advisory audit and the three pip
scan-packages jobs died on a bare KeyError from at least 2026-07-08 to
2026-07-27 without anyone reading it as a missing extra.

Add a contract test for both extras (existence, torch-free, bnb floor
excludes the NaN-at-decode range) plus a check that every extra the
workflow indexes actually exists, and give the workflow a message that
names the problem instead of a raw traceback.
This commit is contained in:
LeoBorcherding 2026-07-28 00:40:49 -05:00
commit 48b5eb1a14
2 changed files with 118 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

20
.github/workflows/security-audit.yml vendored
View file

@ -228,7 +228,15 @@ jobs:
with open("pyproject.toml", "rb") as f:
d = tomllib.load(f)
core = d["project"]["dependencies"]
extras = d["project"]["optional-dependencies"]["huggingfacenotorch"]
try:
extras = d["project"]["optional-dependencies"]["huggingfacenotorch"]
except KeyError:
# A bare KeyError here reads as a generic crash, which is how this
# went unnoticed on the pip branch for three weeks.
raise SystemExit(
"pyproject.toml has no [huggingfacenotorch] extra, so the hf-stack "
"scan set cannot be built. Add the extra, or update this workflow."
)
print("# Auto-generated from pyproject.toml by security-audit.yml.")
print("# core deps + huggingfacenotorch extras.")
for spec in core + extras:
@ -821,7 +829,15 @@ jobs:
with open("pyproject.toml", "rb") as f:
d = tomllib.load(f)
core = d["project"]["dependencies"]
extras = d["project"]["optional-dependencies"]["huggingfacenotorch"]
try:
extras = d["project"]["optional-dependencies"]["huggingfacenotorch"]
except KeyError:
# A bare KeyError here reads as a generic crash, which is how this
# went unnoticed on the pip branch for three weeks.
raise SystemExit(
"pyproject.toml has no [huggingfacenotorch] extra, so the hf-stack "
"scan set cannot be built. Add the extra, or update this workflow."
)
print("# Auto-generated from pyproject.toml by security-audit.yml.")
print("# core deps + huggingfacenotorch extras.")
for spec in core + extras: