Skip to content

Harden Hugging Face Space deployment#25

Open
canstralian wants to merge 5 commits into
mainfrom
fix/huggingface-deploy-hardening
Open

Harden Hugging Face Space deployment#25
canstralian wants to merge 5 commits into
mainfrom
fix/huggingface-deploy-hardening

Conversation

@canstralian
Copy link
Copy Markdown
Owner

Summary

This PR hardens the Hugging Face Space deployment circuit with a small, focused set of changes:

  • Adds an explicit gradio>=6.13.0,<7 runtime dependency so local installs and HF builds share the same dependency contract as the Space metadata.
  • Updates .github/workflows/sync-huggingface.yml so GitHub-to-Hugging Face sync runs only after the CI workflow succeeds on main, while keeping manual dispatch available.
  • Adds optional HF_SPACE_NAME support so the Hugging Face Space name can differ from the GitHub repository name.
  • Documents the deployment contract, required secrets, runtime Space secret, and deployment flow in README.md.
  • Adds the Apache-2.0 LICENSE file to match README frontmatter and badges.

Required configuration

GitHub repository secrets:

HF_TOKEN
HF_USERNAME

Optional GitHub repository secret:

HF_SPACE_NAME

Required Hugging Face Space secret:

OSINT_HASH_SALT

Reverse sync only:

GH_PAT

Testing

Not run locally; changes were made through the GitHub connector. CI should validate workflow-adjacent repo checks after the PR is opened.

Copilot AI review requested due to automatic review settings April 27, 2026 12:55
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 27, 2026

Warning

Rate limit exceeded

@canstralian has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 17 minutes and 23 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 69867677-e87d-40ec-8c18-3963d23895b1

📥 Commits

Reviewing files that changed from the base of the PR and between 085e3cc and a1ddcb4.

📒 Files selected for processing (4)
  • .github/workflows/sync-huggingface.yml
  • LICENSE
  • README.md
  • requirements.txt
✨ Finishing Touches
🧪 Generate unit tests (beta)

✅ Unit Test PR creation complete.

  • Create PR with unit tests
  • Commit unit tests in branch fix/huggingface-deploy-hardening

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds the Apache License 2.0 and significantly updates the README.md by formatting architecture diagrams, deployment instructions, and local development steps into code blocks. It also adds gradio to the project requirements. Feedback includes a recommendation to pin the gradio version to 6.13.0 for consistency and a note regarding the missing sync-huggingface.yml workflow file mentioned in the documentation.

Comment thread requirements.txt Outdated
@@ -1,3 +1,4 @@
gradio>=6.13.0,<7
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To ensure local development perfectly matches the Hugging Face Space environment (as stated in the PR summary), it is recommended to pin gradio to the exact version specified in the README.md frontmatter (6.13.0) rather than using a range. This prevents potential drift if a newer version within the range is installed locally.

gradio==6.13.0

Comment thread README.md
app_file: app.py
```

The GitHub workflow `.github/workflows/sync-huggingface.yml` deploys GitHub `main` to Hugging Face after the `CI` workflow succeeds on `main`. Manual dispatch is also available from the Actions tab.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The documentation describes updates to .github/workflows/sync-huggingface.yml and the use of the HF_SPACE_NAME secret, but the workflow file itself is not included in this pull request. Please ensure the workflow file is added to the PR to match the documentation and complete the implementation.

@kilo-code-bot
Copy link
Copy Markdown
Contributor

kilo-code-bot Bot commented Apr 27, 2026

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)
  • .github/workflows/sync-huggingface.yml
  • LICENSE (new file)
  • README.md
  • requirements.txt

Reviewed by nemotron-3-super-120b-a12b-20230311:free · 320,148 tokens

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 27, 2026

Note

Unit test generation is a public access feature. Expect some limitations and changes as we gather feedback and continue to improve it.


Generating unit tests... This may take up to 20 minutes.

Copy link
Copy Markdown
Owner Author

Review follow-up for pullrequestreview-4181056129:

  • Valid finding addressed: requirements.txt now pins Gradio exactly to the README Space SDK version with gradio==6.13.0.
  • Verified finding as already satisfied: .github/workflows/sync-huggingface.yml is included in this PR and contains the HF_SPACE_NAME handling documented in the README. It appears the workflow-file comment was based on stale or incomplete diff context.

No other review findings were changed.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 27, 2026

✅ Created PR with unit tests: #26

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants