Skip to content

build(deps): bump the actions group across 1 directory with 9 updates - #835

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/actions-2436af7829
Open

build(deps): bump the actions group across 1 directory with 9 updates#835
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/github_actions/actions-2436af7829

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 9 updates in the / directory:

Package From To
huggingface/doc-builder/.github/workflows/build_main_documentation.yml 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
DeterminateSystems/nix-installer-action 22 23
cachix/install-nix-action 31.11.0 31.11.1
Swatinem/rust-cache 2.9.1 2.9.2
huggingface/doc-builder/.github/workflows/build_pr_documentation.yml 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
astral-sh/setup-uv 9.0.0 10.1.0
pypa/gh-action-pypi-publish 1.14.1 1.14.2
sigstore/gh-action-sigstore-python 3.4.0 3.5.0
huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169

Updates huggingface/doc-builder/.github/workflows/build_main_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169

Changelog

Sourced from huggingface/doc-builder/.github/workflows/build_main_documentation.yml's changelog.

Release checklist

  1. Checkout the release branch (for a patch the current release branch, for a new minor version, create one): 
    git checkout -b vXX.xx-release
    The -b is only necessary for creation (so remove it when doing a patch).
  2. Change the version in src/doc_builder/__init__.py and pyproject.toml to the proper value.
  3. Commit these changes with the message: "Release: v<VERSION>".
  4. Add a tag in git to mark the release: 
    git tag v<VERSION> -m 'Adds tag v<VERSION> for pypi'
    Push the tag and release commit to git: 
    git push --tags origin vXX.xx-release
  5. Build the source distribution and the wheel in the top-level directory: 
    rm -rf dist
uv build
  6. Upload the package to the pypi test server first: 
    twine upload dist/* -r testpypi
  7. Check that you can install it in a virtualenv by running: 
    pip install hf-doc-builder
pip uninstall hf-doc-builder
pip install -i https://test.pypi.org/simple/ hf-doc-builder
    It's recommended to check that there are no issues building the docs, so try running a command like doc-builder.
  8. Upload the final version to actual pypi: 
    twine upload dist/* -r pypi
  9. Add release notes to the tag in github once everything is looking hunky-dory.
  10. Go back to the main branch and update the version in src/doc_builder/__init__.py and pyproject.toml to the new version ".dev" and push to main.
Commits
  • 17ccdf1 chore: enable Dependabot weekly GitHub Actions bumps (#790)
  • 47c6b58 fix(ci): pin the doc-builder checkout to the caller's pinned revision (#830)
  • cf20b09 Revert "Comment out schedule for search engine population (#826)" (#827)
  • 9978a41 Comment out schedule for search engine population (#826)
  • c2d27f6 Fix vectorless Meilisearch document payload (#825)
  • 953aa44 Add vectorless full-text docs ingestion (#824)
  • 1b16dac Remove setup.py in favor of pyproject.toml (#816)
  • bcd143e Check anchors in links (#820)
  • 68667a5 fix(kit): accept a lowercase region in language codes (pt-br) (#823)
  • 0ab9ea0 Ship a pre-commit hook for doc-builder style (#818)
  • Additional commits viewable in compare view

Updates DeterminateSystems/nix-installer-action from 22 to 23

Release notes

Sourced from DeterminateSystems/nix-installer-action's releases.

v23

What's Changed

New Contributors

Full Changelog: DeterminateSystems/nix-installer-action@v22...v23

Commits
  • 3138316 Merge pull request #293 from detsys-pr-bot/detsys-ts-update-v2.1.3
  • 3fdd02c Update detsys-ts to v2.1.3 (99d5b05518240632c090b3c3093be30cac088e8c)
  • 042796d Merge pull request #292 from DeterminateSystems/otel-standard-exception-recor...
  • 62cd733 regen
  • a88c0c3 telemetry: record an exception the way OpenTelemetry does
  • a43a456 telemetry: put the build counts in the detsys namespace
  • 9afbed4 telemetry: a caught error is an exception on the span
  • b073798 telemetry: a fact about the run is an attribute, not an event
  • bded454 Merge pull request #291 from DeterminateSystems/grahamc/cleanup-install-events
  • 503d68a Regenerate
  • Additional commits viewable in compare view

Updates cachix/install-nix-action from 31.11.0 to 31.11.1

Release notes

Sourced from cachix/install-nix-action's releases.

v31.11.1

What's Changed

Full Changelog: cachix/install-nix-action@v31.11.0...v31.11.1

Commits
  • 13d8dd5 fix(ci): skip latest installer on x86_64-darwin
  • 875018f Merge pull request #281 from cachix/create-pull-request/patch
  • 6624a11 nix: 2.35.1 -> 2.35.2
  • See full diff in compare view

Updates Swatinem/rust-cache from 2.9.1 to 2.9.2

Release notes

Sourced from Swatinem/rust-cache's releases.

v2.9.2

What's Changed

New Contributors

Full Changelog: Swatinem/rust-cache@v2.9.1...v2.9.2

Changelog

Sourced from Swatinem/rust-cache's changelog.

Changelog

2.9.2

  • Fix credentials.toml cleanup
  • Improvements to cleanup, preserving more valid targets
  • Improvements to cargo install handling
  • Correctly sort/dedupe Rust versions

2.9.1

  • Fix regression in hash calculation

2.9.0

  • Update to node24
  • Support running from within a nix shell
  • Consider all installed toolchains for cache key
  • Use case-insensitive comparison to determine exact cache hit

2.8.2

  • Don't overwrite env for cargo-metadata call

2.8.1

  • Set empty CARGO_ENCODED_RUSTFLAGS when retrieving metadata
  • Various dependency updates

2.8.0

  • Add support for warpbuild cache provider
  • Add new cache-workspace-crates feature

2.7.8

  • Include CPU arch in the cache key

2.7.7

  • Also cache cargo install metadata

2.7.6

  • Allow opting out of caching $CARGO_HOME/bin
  • Add runner OS in cache key
  • Adds an option to do lookup-only of the cache

2.7.5

... (truncated)

Commits
  • 6323deb 2.9.2
  • b16e8d7 bump rollup and rebuild
  • 3bf42ac invert target/profile check in cleanup
  • 6e5b278 correctly sort and dedupe Rust versions
  • 5adc05f Bump the actions group across 1 directory with 3 updates (#368)
  • 66b1e95 fix: support Cargo V2 build dir layout (#371)
  • 72d126e Merge pull request #367 from Swatinem/dependabot/npm_and_yarn/dev-patch-2b495...
  • 48968d2 Bump the dev-patch group with 2 updates
  • 9f151ac update dependencies, rebuild
  • 0e24e5d Bump the actions group across 1 directory with 6 updates (#364)
  • Additional commits viewable in compare view

Updates huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169

Changelog

Sourced from huggingface/doc-builder/.github/workflows/build_pr_documentation.yml's changelog.

Release checklist

  1. Checkout the release branch (for a patch the current release branch, for a new minor version, create one): 
    git checkout -b vXX.xx-release
    The -b is only necessary for creation (so remove it when doing a patch).
  2. Change the version in src/doc_builder/__init__.py and pyproject.toml to the proper value.
  3. Commit these changes with the message: "Release: v<VERSION>".
  4. Add a tag in git to mark the release: 
    git tag v<VERSION> -m 'Adds tag v<VERSION> for pypi'
    Push the tag and release commit to git: 
    git push --tags origin vXX.xx-release
  5. Build the source distribution and the wheel in the top-level directory: 
    rm -rf dist
uv build
  6. Upload the package to the pypi test server first: 
    twine upload dist/* -r testpypi
  7. Check that you can install it in a virtualenv by running: 
    pip install hf-doc-builder
pip uninstall hf-doc-builder
pip install -i https://test.pypi.org/simple/ hf-doc-builder
    It's recommended to check that there are no issues building the docs, so try running a command like doc-builder.
  8. Upload the final version to actual pypi: 
    twine upload dist/* -r pypi
  9. Add release notes to the tag in github once everything is looking hunky-dory.
  10. Go back to the main branch and update the version in src/doc_builder/__init__.py and pyproject.toml to the new version ".dev" and push to main.
Commits
  • 17ccdf1 chore: enable Dependabot weekly GitHub Actions bumps (#790)
  • 47c6b58 fix(ci): pin the doc-builder checkout to the caller's pinned revision (#830)
  • cf20b09 Revert "Comment out schedule for search engine population (#826)" (#827)
  • 9978a41 Comment out schedule for search engine population (#826)
  • c2d27f6 Fix vectorless Meilisearch document payload (#825)
  • 953aa44 Add vectorless full-text docs ingestion (#824)
  • 1b16dac Remove setup.py in favor of pyproject.toml (#816)
  • bcd143e Check anchors in links (#820)
  • 68667a5 fix(kit): accept a lowercase region in language codes (pt-br) (#823)
  • 0ab9ea0 Ship a pre-commit hook for doc-builder style (#818)
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 9.0.0 to 10.1.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.1.0 🌈 New output python-runtime-idand respect NO_PROXY

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 for details on why this can be useful.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.0.1 🌈 Tolerate transient manifest timeouts

Changes

Thank you @​arguile- for making this action more resilient.

... (truncated)

Commits

Updates pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits

Updates sigstore/gh-action-sigstore-python from 3.4.0 to 3.5.0

Release notes

Sourced from sigstore/gh-action-sigstore-python's releases.

v3.5.0

What's Changed

  • The action now uses sigstore 4.5.0
  • Bump other dependencies

Full Changelog: sigstore/gh-action-sigstore-python@v3.4.0...v3.5.0

Commits
  • 790bc6b build(deps): bump github/codeql-action/upload-sarif in the actions group (#445)
  • 513a149 build(deps): bump platformdirs in the python-dependencies group (#446)
  • 74e0040 Bump sigstore from 4.4 to 4.5 (#444)
  • 52538fd build(deps): bump the actions group across 1 directory with 4 updates (#439)
  • cbab91d build(deps): bump the python-dependencies group across 1 directory with 9 upd...
  • 1d3524c build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 in the acti...
  • a174484 build(deps): bump sigstore from 4.3.0 to 4.4.0 in the python-dependencies gro...
  • 0b384a6 build(deps): bump the actions group with 2 updates (#429)
  • f11d8f8 build(deps): bump typing-extensions in the python-dependencies group (#430)
  • 258577b build(deps): bump the python-dependencies group with 2 updates (#428)
  • Additional commits viewable in compare view

Updates huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169

Changelog

Sourced from huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml's changelog.

Release checklist

  1. Checkout the release branch (for a patch the current release branch, for a new minor version, create one): 
    git checkout -b vXX.xx-release
    The -b is only necessary for creation (so remove it when doing a patch).
  2. Change the version in src/doc_builder/__init__.py and pyproject.toml to the proper value.
  3. Commit these changes with the message: "Release: v<VERSION>".
  4. Add a tag in git to mark the release: 
    git tag v<VERSION> -m 'Adds tag v<VERSION> for pypi'
    Push the tag and release commit to git: 
    git push --tags origin vXX.xx-release
  5. Build the source distribution and the wheel in the top-level directory: 
    rm -rf dist
uv build
  6. Upload the package to the pypi test server first: 
    twine upload dist/* -r testpypi
  7. Check that you can install it in a virtualenv by running: 
    pip install hf-doc-builder
pip uninstall hf-doc-builder
pip install -i https://test.pypi.org/simple/ hf-doc-builder
    It's recommended to check that there are no issues building the docs, so try running a command like doc-builder.
  8. Upload the final version to actual pypi: 
    twine upload dist/* -r pypi
  9. Add release notes to the tag in github once everything is looking hunky-dory.
  10. Go back to the main branch and update the version in src/doc_builder/__init__.py and pyproject.toml to the new version ".dev" and push to main.
Commits
  • 17ccdf1 chore: enable Dependabot weekly GitHub Actions bumps (#790)
  • 47c6b58 fix(ci): pin the doc-builder checkout to the caller's pinned revision (#830)
  • cf20b09 Revert "Comment out schedule for search engine population (#826)" (#827)
  • 9978a41 Comment out schedule for search engine population (#826)
  • c2d27f6 Fix vectorless Meilisearch document payload (#825)
  • 953aa44 Add vectorless full-text docs ingestion (#824)
  • 1b16dac Remove setup.py in favor of pyproject.toml (#816)
  • bcd143e Check anchors in links (#820)
  • 68667a5 fix(kit): accept a lowercase region in language codes (pt-br) (#823)
  • 0ab9ea0 Ship a pre-commit hook for doc-builder style (#818)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the actions group across 1 directory with 9 updates
f4a261b 
Bumps the actions group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [huggingface/doc-builder/.github/workflows/build_main_documentation.yml](https://github.com/huggingface/doc-builder) | `7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c` | `17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169` |
| [DeterminateSystems/nix-installer-action](https://github.com/determinatesystems/nix-installer-action) | `22` | `23` |
| [cachix/install-nix-action](https://github.com/cachix/install-nix-action) | `31.11.0` | `31.11.1` |
| [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `2.9.1` | `2.9.2` |
| [huggingface/doc-builder/.github/workflows/build_pr_documentation.yml](https://github.com/huggingface/doc-builder) | `7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c` | `17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `9.0.0` | `10.1.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.1` | `1.14.2` |
| [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python) | `3.4.0` | `3.5.0` |
| [huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml](https://github.com/huggingface/doc-builder) | `7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c` | `17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169` |



Updates `huggingface/doc-builder/.github/workflows/build_main_documentation.yml` from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md)
- [Commits](huggingface/doc-builder@7ccf6c0...17ccdf1)

Updates `DeterminateSystems/nix-installer-action` from 22 to 23
- [Release notes](https://github.com/determinatesystems/nix-installer-action/releases)
- [Commits](DeterminateSystems/nix-installer-action@ef8a148...3138316)

Updates `cachix/install-nix-action` from 31.11.0 to 31.11.1
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](cachix/install-nix-action@630ae54...13d8dd5)

Updates `Swatinem/rust-cache` from 2.9.1 to 2.9.2
- [Release notes](https://github.com/swatinem/rust-cache/releases)
- [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md)
- [Commits](Swatinem/rust-cache@c193711...6323deb)

Updates `huggingface/doc-builder/.github/workflows/build_pr_documentation.yml` from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md)
- [Commits](huggingface/doc-builder@7ccf6c0...17ccdf1)

Updates `astral-sh/setup-uv` from 9.0.0 to 10.1.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@c771a70...bec219d)

Updates `pypa/gh-action-pypi-publish` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@ba38be9...dc37677)

Updates `sigstore/gh-action-sigstore-python` from 3.4.0 to 3.5.0
- [Release notes](https://github.com/sigstore/gh-action-sigstore-python/releases)
- [Changelog](https://github.com/sigstore/gh-action-sigstore-python/blob/main/CHANGELOG.md)
- [Commits](sigstore/gh-action-sigstore-python@5b79a39...790bc6b)

Updates `huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml` from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md)
- [Commits](huggingface/doc-builder@7ccf6c0...17ccdf1)

---
updated-dependencies:
- dependency-name: huggingface/doc-builder/.github/workflows/build_main_documentation.yml
  dependency-version: 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: DeterminateSystems/nix-installer-action
  dependency-version: '23'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: cachix/install-nix-action
  dependency-version: 31.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: Swatinem/rust-cache
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml
  dependency-version: 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: sigstore/gh-action-sigstore-python
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml
  dependency-version: 17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169
  dependency-type: direct:production
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 21, 2026
hf-security-analysis Bot added a commit that referenced this pull request Sep 21, 2026
@hf-security-analysis
fix(ci): harden workflow files flagged on #835
0247304
@hf-security-analysis hf-security-analysis Bot mentioned this pull request Sep 21, 2026
Merged
@HuggingFaceDocBuilderDev

HuggingFaceDocBuilderDev commented Sep 21, 2026

Copy link
Copy Markdown

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

@hf-security-analysis
fix(ci): harden GitHub Actions workflows (#835) (#836)
c2d5bf6 
Automated hardening of the workflow files flagged on #835.

> [!WARNING]
> **This narrows what the workflow can reach.** Job permissions were
declared in `.github/workflows/build_kernel.yaml`,
`.github/workflows/build_kernel_cpu.yaml`,
`.github/workflows/build_kernel_macos.yaml`,
`.github/workflows/build_kernel_rocm.yaml`,
`.github/workflows/build_kernel_windows.yaml`,
`.github/workflows/build_kernel_xpu.yaml`,
`.github/workflows/check_variants.yaml`, `.github/workflows/lint.yml`,
`.github/workflows/nix_checks.yml`, `.github/workflows/test_e2e.yaml`,
`.github/workflows/test_extra_commands.yaml`,
`.github/workflows/update_cache.yaml`. Each job now gets only the scopes
its steps were read to need — if one of them does something this could
not see, it will fail on the next run. The table below says which step
drove each scope.

Targets `dependabot/github_actions/actions-2436af7829`. Files changed,
and what changed them:

- `.github/workflows/build_kernel.yaml` — action pins; job permissions
- `.github/workflows/build_kernel_cpu.yaml` — action pins; job
permissions
- `.github/workflows/build_kernel_macos.yaml` — job permissions
- `.github/workflows/build_kernel_rocm.yaml` — action pins; job
permissions
- `.github/workflows/build_kernel_windows.yaml` — job permissions
- `.github/workflows/build_kernel_xpu.yaml` — action pins; job
permissions
- `.github/workflows/check_variants.yaml` — job permissions
- `.github/workflows/lint.yml` — job permissions
- `.github/workflows/nix_checks.yml` — action pins; job permissions
- `.github/workflows/publish_kernels.yml` — action pins
- `.github/workflows/test_e2e.yaml` — action pins; job permissions
- `.github/workflows/test_extra_commands.yaml` — action pins; job
permissions
- `.github/workflows/update_cache.yaml` — action pins; job permissions

Fixed by this PR:

- **HIGH** `unpinned-action` (pinact) —
.github/workflows/build_kernel.yaml:31
- **HIGH** `unpinned-action` (pinact) —
.github/workflows/build_kernel_cpu.yaml:24
- **HIGH** `unpinned-action` (pinact) —
.github/workflows/build_kernel_rocm.yaml:24
- **HIGH** `unpinned-action` (pinact) —
.github/workflows/build_kernel_xpu.yaml:24
- **HIGH** `unpinned-action` (pinact) —
.github/workflows/nix_checks.yml:24
- **HIGH** `unpinned-action` (pinact) —
.github/workflows/publish_kernels.yml:251
- **HIGH** `unpinned-action` (pinact) —
.github/workflows/publish_kernels.yml:323
- **HIGH** `unpinned-action` (pinact) —
.github/workflows/test_e2e.yaml:37
- **HIGH** `unpinned-action` (pinact) —
.github/workflows/test_extra_commands.yaml:23
- **HIGH** `unpinned-action` (pinact) —
.github/workflows/update_cache.yaml:25
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel.yaml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel.yaml:18
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel.yaml:69
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel_cpu.yaml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel_cpu.yaml:18
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel_macos.yaml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel_macos.yaml:18
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel_rocm.yaml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel_rocm.yaml:18
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel_windows.yaml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel_windows.yaml:18
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel_xpu.yaml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/build_kernel_xpu.yaml:18
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/check_variants.yaml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/check_variants.yaml:18
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/lint.yml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/lint.yml:18
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/lint.yml:35
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/lint.yml:51
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/nix_checks.yml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/nix_checks.yml:18
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/test_e2e.yaml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/test_e2e.yaml:29
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/test_e2e.yaml:111
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/test_e2e.yaml:155
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/test_extra_commands.yaml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/test_extra_commands.yaml:18
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/update_cache.yaml:1
- **MEDIUM** `excessive-permissions` (zizmor) —
.github/workflows/update_cache.yaml:12

**This does not fix everything.** 10 further finding(s) (2 critical, 1
high, 7 medium) need a decision this bot should not make for you. They
are in the security channel with their locations — deliberately not
repeated here, since this repository may be public and they are not
fixed yet.

### Permissions

`.github/workflows/build_documentation.yaml`

> `build` was left as it is — This job only calls the external reusable
workflow
huggingface/doc-builder/.github/workflows/build_main_documentation.yml,
whose jobs and steps are not in this file, so the token scopes it
requires cannot be determined here.

`.github/workflows/build_kernel.yaml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | actions/checkout needs contents: read;
the nix-installer, cachix (authenticated via a secret, not the
GITHUB_TOKEN) and upload-artifact steps in the same run require no token
scopes. |
| `test` | `contents: read` | actions/checkout needs contents: read;
download-artifact pulls an artifact produced by the build job in the
same run, and the docker build/run steps use no GitHub API. |

`.github/workflows/build_kernel_cpu.yaml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | Only actions/checkout needs the token
(contents: read); the nix-installer, cachix (which uses a secret, not
the GITHUB_TOKEN), and the nix build/test steps make no GitHub API
writes. |

`.github/workflows/build_kernel_macos.yaml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | Only actions/checkout needs the token
(contents: read); the Nix/Cachix steps and Metal build just compile code
and the cachix auth token is a secret, not a token scope. |

`.github/workflows/build_kernel_rocm.yaml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | Only actions/checkout needs the token
(contents: read); the nix-installer and cachix steps authenticate via a
secret, not the GITHUB_TOKEN, and the nix build steps use no API access.
|

`.github/workflows/build_kernel_windows.yaml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | Only actions/checkout needs the token
(contents: read); the remaining steps are CUDA/Rust/Python toolchain
setup, cache actions (which use the cache service, not the token) and
local compilation — note the nix-builder\scripts\windows\builder.ps1
build script is not in this file, but its invocation is a plain kernel
build with no API usage. |

`.github/workflows/build_kernel_xpu.yaml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | Only `actions/checkout` needs the token
(contents: read); the nix-installer, cachix (authenticated via a secret,
not the GITHUB_TOKEN) and `nix build` steps make no GitHub API writes. |

`.github/workflows/build_pr_documentation.yaml`

> `build` was left as it is — This job only calls the external reusable
workflow
huggingface/doc-builder/.github/workflows/build_pr_documentation.yml,
whose job definitions are not in this file, so the required token scopes
cannot be read here.

`.github/workflows/check_variants.yaml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | Only actions/checkout needs the token
(contents: read); the remaining steps run nix evaluations, git diff, and
a local script (nix-builder/scripts/gen_variants_markdown.py, whose
contents aren't in this file but which only regenerates a tracked
markdown file for comparison) without any API calls or pushes. |

`.github/workflows/lint.yml`

| job | granted | why |
|---|---|---|
| `lint` | `contents: read` | Only actions/checkout plus ruff-action
lint/format checks that operate on local files, so contents: read is
sufficient. |
| `griffe` | `contents: read` | actions/checkout with fetch-depth: 0 and
a local uvx griffe API-diff run against the main ref; no API writes, so
contents: read. |
| `validate-dependencies` | `contents: read` | actions/checkout followed
by a local diff of two checked-out files needs only contents: read. |

`.github/workflows/nix_checks.yml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | Only actions/checkout needs the token
(contents: read); the nix-installer and cachix actions authenticate via
their own inputs/secrets and the remaining steps just run `nix fmt`/`nix
build` locally, so no write scopes are needed. |

`.github/workflows/test_e2e.yaml`

| job | granted | why |
|---|---|---|
| `init-build-upload` | `contents: read` | actions/checkout needs
contents: read; the nix build/upload steps push artifacts to the Hugging
Face Hub using HF_TOKEN, not the GitHub token, so no write scopes are
required (cachix and nix-installer actions use their own secrets). |
| `download-and-test` | `contents: read` | actions/checkout needs
contents: read; setup-uv and dtolnay/rust-toolchain only download public
tooling and the test step pulls the kernel from the HF Hub, requiring no
GitHub token scopes. |
| `cleanup` | `{}` — nothing | No checkout and no GitHub API use — the
only step deletes Hugging Face Hub repos via huggingface_hub with
HF_TOKEN, so no GITHUB_TOKEN scopes are needed (setup-uv only fetches
public release assets). |

`.github/workflows/test_extra_commands.yaml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | actions/checkout needs contents: read;
the nix-installer and cachix actions only fetch installers/binary caches
(cachix uses its own auth token, not GITHUB_TOKEN), and the two nix run
steps just build/test locally, so no write scopes are required. |

`.github/workflows/test_kernels.yaml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | Only actions/checkout needs the token
(contents: read); the test, mypy, coverage-rendering and
actions/upload-artifact steps all operate on the checked-out tree within
the same run, so the workflow's declared packages: write is unnecessary
— the PR comment is posted by a separate downstream workflow_run
workflow, not here. |

`.github/workflows/update_cache.yaml`

| job | granted | why |
|---|---|---|
| `build` | `contents: read` | Only actions/checkout needs the token
(contents: read); the nix-installer and cachix steps authenticate to
Cachix with a secret, not the GITHUB_TOKEN, and `nix build` just builds
locally. |

`.github/workflows/upload_pr_documentation.yaml`

> `build` was left as it is — This job only declares `uses:` to call an
external reusable workflow
(huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml)
that is not in this file, so its token needs cannot be read here; based
on the workflow_run trigger and comment_bot_token input it likely needs
at least `actions: read` to fetch the triggering run's artifacts and
`pull-requests: write` to post a docs preview comment — verify against
the pinned doc-builder workflow.

Anything not listed above keeps the permissions it had. To measure a job
this could not read, add
[`GitHubSecurityLab/actions-permissions/monitor`](https://github.com/GitHubSecurityLab/actions-permissions)
to it and run the workflow — it reports the minimum the run actually
used.

Pinning changes come from `pinact` and are mechanical. Any other change
was generated by Claude — read it before merging.
<!--slack ts:1789951225.673349 channel:C0AJSP0D53L-->

Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@HuggingFaceDocBuilderDev