From 29d199aba8b8effc7bd3f7cb63282440f61fe66d Mon Sep 17 00:00:00 2001 From: "Eliott C." Date: Thu, 22 Oct 2026 07:18:57 +0200 Subject: [PATCH] Use HF Trusted Publisher token in update_metadata workflow (#15096) Co-authored-by: Sayak Paul --- .github/workflows/update_metadata.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update_metadata.yml b/.github/workflows/update_metadata.yml index e5c443d61a..bae572b41b 100644 --- a/.github/workflows/update_metadata.yml +++ b/.github/workflows/update_metadata.yml @@ -14,6 +14,7 @@ jobs: update_metadata: permissions: contents: read + id-token: write # needed for the HF Trusted Publisher token exchange runs-on: ubuntu-22.04 defaults: run: @@ -30,11 +31,12 @@ jobs: - name: Setup environment run: | pip install --upgrade pip - pip install datasets pandas + pip install datasets pandas "huggingface_hub>=1.19.0" pip install .[torch] - name: Update metadata env: - HF_TOKEN: ${{ secrets.SAYAK_HF_TOKEN }} + # Short-lived token (1h) from the Hub's Trusted Publishers, scoped to this dataset only + HF_OIDC_RESOURCE: datasets/huggingface/diffusers-metadata run: | python utils/update_metadata.py --commit_sha ${{ github.sha }}