From 8c606a70b5e5d9eeaae57610901989e4ddaec582 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 11 May 2026 05:42:45 -0700 Subject: [PATCH] studio: authenticate HF downloads across Studio CI workflows (#5370) The Mac json-images job (run 25664825326) hit the 30 min step budget while downloading 4 GiB of GGUF assets unauthenticated. The log shows the explicit "You are sending unauthenticated requests to the HF Hub" warning followed by 30 min of zero progress, then job cancellation. macos-14, ubuntu-latest, and windows-latest runners share NAT egress IP pools across the whole GitHub Actions fleet, so the anonymous per-IP rate limit kicks in well before the file size alone would suggest. An authenticated token shifts the budget to per-user. Add HF_TOKEN: secrets.HF_TOKEN to every hf download step across the nine studio CI workflows that pull from HF. The env is scoped to the download step only, not the job, so every other step still runs without HF_TOKEN in its environment and the GitHub secret-masking layer handles log scrubbing. For the Mac json-images step specifically, the model and mmproj downloads now run in parallel under wait, and an ls -lhL after the wait surfaces a partial download as an obvious failure instead of a silent 30 min timeout on the next inference/load call. --- .github/workflows/studio-api-smoke.yml | 2 ++ .github/workflows/studio-inference-smoke.yml | 6 ++++++ .github/workflows/studio-mac-api-smoke.yml | 2 ++ .../workflows/studio-mac-inference-smoke.yml | 19 +++++++++++++++++-- .github/workflows/studio-mac-ui-smoke.yml | 2 ++ .github/workflows/studio-ui-smoke.yml | 2 ++ .../workflows/studio-windows-api-smoke.yml | 2 ++ .../studio-windows-inference-smoke.yml | 6 ++++++ .github/workflows/studio-windows-ui-smoke.yml | 2 ++ 9 files changed, 41 insertions(+), 2 deletions(-) diff --git a/.github/workflows/studio-api-smoke.yml b/.github/workflows/studio-api-smoke.yml index 4e8cc5c9c3..742cba9ed9 100644 --- a/.github/workflows/studio-api-smoke.yml +++ b/.github/workflows/studio-api-smoke.yml @@ -80,6 +80,8 @@ jobs: - name: Prime HF_HOME with the GGUF if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache diff --git a/.github/workflows/studio-inference-smoke.yml b/.github/workflows/studio-inference-smoke.yml index a1b54d6e65..19e1ab9cc5 100644 --- a/.github/workflows/studio-inference-smoke.yml +++ b/.github/workflows/studio-inference-smoke.yml @@ -94,6 +94,8 @@ jobs: - name: Prime HF_HOME with the GGUF if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache @@ -331,6 +333,8 @@ jobs: - name: Download GGUF if cache miss if: steps.cache-gguf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p gguf-cache @@ -637,6 +641,8 @@ jobs: - name: Prime HF_HOME with the GGUF + mmproj if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache diff --git a/.github/workflows/studio-mac-api-smoke.yml b/.github/workflows/studio-mac-api-smoke.yml index 28a491840b..98596f374a 100644 --- a/.github/workflows/studio-mac-api-smoke.yml +++ b/.github/workflows/studio-mac-api-smoke.yml @@ -65,6 +65,8 @@ jobs: - name: Prime HF_HOME with the GGUF if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache diff --git a/.github/workflows/studio-mac-inference-smoke.yml b/.github/workflows/studio-mac-inference-smoke.yml index 066ddf87b8..97efe3e74d 100644 --- a/.github/workflows/studio-mac-inference-smoke.yml +++ b/.github/workflows/studio-mac-inference-smoke.yml @@ -88,6 +88,8 @@ jobs: - name: Prime HF_HOME with the GGUF if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache @@ -325,6 +327,8 @@ jobs: - name: Download GGUF if cache miss if: steps.cache-gguf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p gguf-cache @@ -679,13 +683,24 @@ jobs: - name: Prime HF_HOME with the GGUF + mmproj if: steps.cache-hf.outputs.cache-hit != 'true' + # Authenticated + parallel: shared macos-14 NAT egress stalls + # multi-GB anonymous downloads. + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache HF_HUB_ENABLE_HF_TRANSFER=1 \ - hf download "$GGUF_REPO" "$GGUF_FILE" + hf download "$GGUF_REPO" "$GGUF_FILE" & + MODEL_PID=$! HF_HUB_ENABLE_HF_TRANSFER=1 \ - hf download "$GGUF_REPO" "$MMPROJ_FILE" + hf download "$GGUF_REPO" "$MMPROJ_FILE" & + MMPROJ_PID=$! + wait "$MODEL_PID" + wait "$MMPROJ_PID" + # Fail loud on a partial download instead of in the next step. + find hf-cache -name "$GGUF_FILE" -o -name "$MMPROJ_FILE" \ + | xargs -I{} ls -lhL {} - name: Install Studio (--local, --no-torch) env: diff --git a/.github/workflows/studio-mac-ui-smoke.yml b/.github/workflows/studio-mac-ui-smoke.yml index 75e958e023..c921ddf63e 100644 --- a/.github/workflows/studio-mac-ui-smoke.yml +++ b/.github/workflows/studio-mac-ui-smoke.yml @@ -65,6 +65,8 @@ jobs: - name: Prime HF_HOME with the GGUF if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache diff --git a/.github/workflows/studio-ui-smoke.yml b/.github/workflows/studio-ui-smoke.yml index 6c4c66acd3..756eea64b2 100644 --- a/.github/workflows/studio-ui-smoke.yml +++ b/.github/workflows/studio-ui-smoke.yml @@ -79,6 +79,8 @@ jobs: - name: Prime HF_HOME with the GGUF if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache diff --git a/.github/workflows/studio-windows-api-smoke.yml b/.github/workflows/studio-windows-api-smoke.yml index db2e8a26a0..d9ed5d5594 100644 --- a/.github/workflows/studio-windows-api-smoke.yml +++ b/.github/workflows/studio-windows-api-smoke.yml @@ -72,6 +72,8 @@ jobs: - name: Prime HF_HOME with the GGUF if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache diff --git a/.github/workflows/studio-windows-inference-smoke.yml b/.github/workflows/studio-windows-inference-smoke.yml index e1406b7f45..b33b6f9563 100644 --- a/.github/workflows/studio-windows-inference-smoke.yml +++ b/.github/workflows/studio-windows-inference-smoke.yml @@ -82,6 +82,8 @@ jobs: - name: Prime HF_HOME with the GGUF if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache @@ -382,6 +384,8 @@ jobs: - name: Download GGUF if cache miss if: steps.cache-gguf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p gguf-cache @@ -776,6 +780,8 @@ jobs: - name: Prime HF_HOME with the GGUF + mmproj if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache diff --git a/.github/workflows/studio-windows-ui-smoke.yml b/.github/workflows/studio-windows-ui-smoke.yml index c550f04827..a5a4753ba5 100644 --- a/.github/workflows/studio-windows-ui-smoke.yml +++ b/.github/workflows/studio-windows-ui-smoke.yml @@ -81,6 +81,8 @@ jobs: - name: Prime HF_HOME with the GGUF if: steps.cache-hf.outputs.cache-hit != 'true' + env: + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | python -m pip install --upgrade huggingface_hub hf_transfer mkdir -p hf-cache