The Mac json-images job (run 25664825326) hit the 30 min step budget
while downloading 4 GiB of GGUF assets unauthenticated. The log shows
the explicit "You are sending unauthenticated requests to the HF Hub"
warning followed by 30 min of zero progress, then job cancellation.
macos-14, ubuntu-latest, and windows-latest runners share NAT egress
IP pools across the whole GitHub Actions fleet, so the anonymous
per-IP rate limit kicks in well before the file size alone would
suggest. An authenticated token shifts the budget to per-user.
Add HF_TOKEN: secrets.HF_TOKEN to every hf download step across the
nine studio CI workflows that pull from HF. The env is scoped to the
download step only, not the job, so every other step still runs
without HF_TOKEN in its environment and the GitHub secret-masking
layer handles log scrubbing.
For the Mac json-images step specifically, the model and mmproj
downloads now run in parallel under wait, and an ls -lhL after the
wait surfaces a partial download as an obvious failure instead of a
silent 30 min timeout on the next inference/load call.
8c606a70b5