From 51df3e7aafc6afd5bc729f9da537303afefb8f0b Mon Sep 17 00:00:00 2001 From: Zhenshan Xie Date: Fri, 11 Sep 2026 13:45:47 -0700 Subject: [PATCH] fix(ci): pass HF_TOKEN through to Community GPU Community GPU currently downloads Hugging Face checkpoints with no token, so gated models (e.g. sam3) fail to download, one of the issues flagged as found-but-not-yet-fixed after the CI restructuring in #1262/#1268. huggingface_hub reads HF_TOKEN from the process environment automatically (verified directly: setting os.environ["HF_TOKEN"] and calling huggingface_hub.get_token() picks it up), so no change is needed in tools.community_gpu_ci to consume it. This only wires the existing HF_TOKEN secret (added to the gpu-ci-dispatch environment) through the trusted runner into the docker run invocation that actually runs tools.community_gpu_ci. Deliberately not attempted here: making hf_revision mandatory in family manifests, which would address the separate "no fixed revision pinning" half of the same complaint. Checked first: 76 of the ~85 premerge manifests have no hf_revision set today (including bert), so requiring it in code would immediately break nearly every family's GPU test rather than being a narrow fix. That needs a separate, family-owner-reviewed effort to backfill real pinned revisions, not a code change bundled here. Signed-off-by: Zhenshan Xie --- .github/workflows/community-ci.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/community-ci.yml b/.github/workflows/community-ci.yml index 8e2d5be80..a76710a64 100644 --- a/.github/workflows/community-ci.yml +++ b/.github/workflows/community-ci.yml @@ -563,6 +563,7 @@ jobs: FAMILIES: ${{ needs.gpu-authorize.outputs.families }} ADDED_FAMILIES: ${{ needs.gpu-authorize.outputs.added_families }} SCOPE: ${{ needs.gpu-authorize.outputs.scope }} + HF_TOKEN: ${{ secrets.HF_TOKEN }} run: | set -euo pipefail brev exec "$INSTANCE_NAME" "git init /tmp/model_connect && cd /tmp/model_connect && git remote add origin https://github.com/$GITHUB_REPOSITORY.git && git fetch --depth 2 origin refs/pull/$PR_NUMBER/merge && test \"\$(git rev-parse FETCH_HEAD)\" = $MERGE_SHA && git checkout --detach $MERGE_SHA" @@ -575,6 +576,12 @@ jobs: # selected family DSOs, and configured CTest tree. It then stages # checkpoint revisions and uses E2ERunner's explicit premerge case # selection plus JUnit validation, which rejects skips and omissions. + # HF_TOKEN: some premerge checkpoints (e.g. sam3) are gated and + # fail to download without authorization. huggingface_hub reads + # HF_TOKEN from the environment automatically (verified directly + # against huggingface_hub.get_token()); no code change is needed + # in tools.community_gpu_ci to consume it. GitHub Actions masks + # the secret value everywhere it appears, including here. echo "Changed families: $FAMILIES; added families: $ADDED_FAMILIES (scope: $SCOPE)" python3 -m tools.brev_exec \ --instance "$INSTANCE_NAME" \ @@ -585,6 +592,7 @@ jobs: -e "TRTMC_GPU_SCOPE=$SCOPE" \ -e "TRTMC_GPU_FAMILIES=$FAMILIES" \ -e "TRTMC_GPU_ADDED_FAMILIES=$ADDED_FAMILIES" \ + -e "HF_TOKEN=$HF_TOKEN" \ -e CMAKE_CUDA_ARCHITECTURES=89 \ trtmc-quickstart-gpu python3.12 -m tools.community_gpu_ci echo "conclusion=success" >> "$GITHUB_OUTPUT"