From 709e3c426f740b1dc1cc8f55f41859a7ac1810b4 Mon Sep 17 00:00:00 2001
From: Victor Nogueira <felladrin@gmail.com>
Date: Tue, 28 Jul 2026 15:24:50 -0300
Subject: [PATCH] Fix the Hugging Face deploy by pinning the action's build
 branch

The deploy has been broken since #2145 pinned the action by digest. The
first dispatch after that pin failed with:

    File not found: '.../huggingface-sync/60850d5a.../dist/index.js'

JacobLinCool/huggingface-sync gitignores `dist/` and ships its build output
on the `v1` branch. Its release tags point at source commits, so any digest
resolved from a tag lands on a tree with no `dist/index.js`, and the step
fails before it runs. The workflow used the mutable `v1` ref until #2145,
which is why it worked before.

Pins the tip of the `v1` branch instead, keeping a digest pin while pointing
at a tree that actually contains the entrypoint. That commit also declares
`node24`, so the Node 20 deprecation warning goes away too.

Also disables Renovate for this one action. It resolves digests from tags,
so every update it proposes reintroduces the same breakage; it has already
done so twice (#2145, #2159).
---
 .github/workflows/deploy-to-hugging-face.yml |  6 +++++-
 renovate.json                                | 10 +++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy-to-hugging-face.yml b/.github/workflows/deploy-to-hugging-face.yml
index ecf0e34f..12688c4d 100644
--- a/.github/workflows/deploy-to-hugging-face.yml
+++ b/.github/workflows/deploy-to-hugging-face.yml
@@ -11,7 +11,11 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7
-      - uses: JacobLinCool/huggingface-sync@60850d5a74ea004fc094f77c960c2c8bd9a0f9d1 # v1.3.1
+      # Pin to the tip of the action's `v1` branch, which is where its build
+      # output lives. Its release tags point at source commits, and `dist/` is
+      # gitignored there, so a tag digest resolves to a tree with no
+      # `dist/index.js` and the step fails before it runs.
+      - uses: JacobLinCool/huggingface-sync@48eb49940149dc1015d8294621cb203635fe9ff3 # v1 branch, 2026-05-12
         with:
           github: ${{ secrets.GITHUB_TOKEN }}
           user: ${{ vars.HF_SPACE_OWNER }}
diff --git a/renovate.json b/renovate.json
index dcbd8767..4dc9361f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,4 +1,12 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["local>felladrin/.github:renovate-config"]
+  "extends": ["local>felladrin/.github:renovate-config"],
+  "packageRules": [
+    {
+      "description": "Keep the pin on the action's v1 branch tip. Its release tags point at source commits where dist/ is gitignored, so any tag digest resolves to a tree with no dist/index.js and the deploy fails. Renovate cannot resolve a branch tip, so it has nothing correct to offer here.",
+      "matchManagers": ["github-actions"],
+      "matchDepNames": ["JacobLinCool/huggingface-sync"],
+      "enabled": false
+    }
+  ]
 }