+ QV-jRt^RIt^RIHt^RIHt^RIHt^RIH t H t Rt Rt !RR ] ]4tR R ltR R ltRRRR/RRlltRR/RRlltRRRRRRRR/RRlltR#)uKeyless CI/CD authentication via OIDC token exchange ("Trusted Publishers"). A CI job proves its identity to the Hub with a short-lived OIDC id token minted by its CI provider (e.g. GitHub Actions), then exchanges it at ``POST {ENDPOINT}/oauth/token`` (RFC 8693) for a short-lived Hugging Face token — no long-lived ``HF_TOKEN`` secret to store. This module is self-contained: it only handles minting the provider id token and the exchange. It deliberately does not register a public API or a CLI verb; the integration point is the token resolution in ``utils/_auth.py`` (see ``_get_token_from_oidc``). Docs: https://huggingface.co/docs/hub/trusted-publishers N)Enum) constants) OIDCError) get_sessionhf_raise_for_statusz/urn:ietf:params:oauth:grant-type:token-exchangez)urn:ietf:params:oauth:token-type:id_tokenc]tRt^(tRtRtRtR#)ProviderzRCI providers that can mint an OIDC id token natively. GitHub Actions only for now.githubN)__name__ __module__ __qualname____firstlineno____doc__GITHUB__static_attributes__r f/Volumes/fast/ai/experiments/ui-tars-smoke/.venv/lib/python3.14/site-packages/huggingface_hub/_oidc.pyrr(s \ Frrc2V^8dQhR\R,/#)returnN)r)formats"r __annotate__r.sDrcn\PPR4R8Xd\P#R#)zYDetect the CI provider able to mint an OIDC id token, or `None` if not in a supported CI.GITHUB_ACTIONStrueN)osenvirongetrrr rrdetect_providerr.s% zz~~&'61 rc0V^8dQhR\R\/#)raudiencer)str)rs"rrr5s$$S$S$rc>\PPR4p\PPR4pV'd V'g \R4h\ 4PVRV/RRV 2/R7p\ V4VP 4R,#) zMint an OIDC id token from the GitHub Actions runtime. Relies on the `ACTIONS_ID_TOKEN_REQUEST_URL` / `ACTIONS_ID_TOKEN_REQUEST_TOKEN` env vars, which GitHub only injects when the job declares `permissions: id-token: write`. ACTIONS_ID_TOKEN_REQUEST_URLACTIONS_ID_TOKEN_REQUEST_TOKENzCannot request an OIDC id token from GitHub Actions. Make sure the workflow job sets `permissions: id-token: write`. See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connectr! AuthorizationzBearer )paramsheadersvalue)rrrrrrjson)r! request_url request_tokenresponses& r_get_github_oidc_tokenr.5s **..!?@KJJNN#CDM m M  }  H% GM?";<!H ! ==?7 ##rproviderr!cnV^8dQhR\\,R,R\R,R\/#)rr/Nr!r)rr")rs"rrrLs4kk3 5kd k^akrc T;'g\PpT;'g \4pRPR\44pVf\ RV R24hV\P 8Xd \V4#\RV RV R24h)aMint a raw OIDC id token (JWT) from the current CI provider. Args: provider (`str`, *optional*): CI provider to use. Auto-detected from the environment when omitted. audience (`str`, *optional*): The `aud` claim to request. Defaults to `constants.ENDPOINT` so it matches the endpoint that validates it (respects `HF_ENDPOINT`/staging). Returns: `str`: The raw id token (JWT) to pass to [`exchange_oidc_token`]. z, c38"TFqPxK R#5i)N)r)).0ps& r !get_oidc_token..[s48a''8szONo supported CI OIDC provider detected. Trusted Publishers currently supports: .zOIDC provider 'z#' is not supported yet. Supported: ) rENDPOINTrjoinrrrr.NotImplementedError)r/r! supporteds$$ rget_oidc_tokenr<Ls--9--H,,?,H 4844Iijsittuvww8??"%h// z9\]f\gghi jjrendpointcVV^8dQhR\R\R\R,R\/#)r subject_tokenresourcer=Nr)r"dict)rs"rrrcs-#d ^brc \4PT;'g\P R2R\R\ RVRV/R7p\ V4VP4#)uExchange a CI OIDC id token for a short-lived Hugging Face token (RFC 8693). Args: subject_token (`str`): The raw OIDC id token (JWT) from the CI provider. Its `aud` claim must be the Hub URL. resource (`str`): What to scope the token to: a Hub repo (`namespace/name`, `datasets/namespace/name`, `spaces/namespace/name`, `kernels/namespace/name`) for a write token, or a bare Hub username for a read-only `gated-repos` token. endpoint (`str`, *optional*): Hub endpoint. Defaults to `constants.ENDPOINT` (respects `HF_ENDPOINT`/staging). Returns: `dict`: The token-exchange response, e.g. `{"access_token": "hf_jwt_…", "token_type": "bearer", "expires_in": 3600, ...}`. z /oauth/token grant_typesubject_token_typer?r@)r*)rpostrr8_TOKEN_EXCHANGE_GRANT_TYPE_ID_TOKEN_TYPErr*)r?r@r=r-s$$$ rexchange_oidc_tokenrHcsd"}!!  ) )y)) *,7 4 . ]   "H! ==?rr?c V^8dQhR\R\R,R\\,R,R\R,R\R,R\/#)rr@r?Nr/r!r=r)r"rrA)rs"rrrsc"b"b"b:"bnt# "b Dj "b Dj "b "brcT;'g\PpVf\Y#;'gTR7p\WVR7#)ujMint a CI OIDC id token and exchange it for a Hugging Face token. Convenience wrapper around [`get_oidc_token`] + [`exchange_oidc_token`]. Returns the raw exchange response (it does not persist anything — the caller decides what to do with the token). Args: resource (`str`): Repo or username to scope the token to. See [`exchange_oidc_token`]. subject_token (`str`, *optional*): A pre-minted OIDC id token to exchange directly. Use this for CI providers not yet supported natively (e.g. GitLab): mint the id token in your job and pass it here. When omitted, the token is minted from the detected `provider`. provider (`str`, *optional*): CI provider. Auto-detected when omitted. Ignored when `subject_token` is provided. audience (`str`, *optional*): The `aud` claim to request. Defaults to the resolved `endpoint`, so it matches the endpoint that validates it. endpoint (`str`, *optional*): Hub endpoint. Defaults to `constants.ENDPOINT`. Returns: `dict`: The token-exchange response (`access_token`, `token_type`, `expires_in`, ...). )r/r!)r?r@r=)rr8r<rH)r@r?r/r!r=s$$$$$r oidc_loginrKs=>--9--H&CWCWxX ]X` aar)rrenumrrerrorsrutilsrrrFrGr"rrr.r<rHrKr rrrPs  3O<sD $.kkUYk.UY<"b!%"b'+ "b  "b  "b"br