bk99.de entertain the web since 1997

bk99.de
HF · CI/CDCurated

Moving GitHub CI to Hugging Face Jobs

Summary

The guide moves compute-intensive CI steps from GitHub Actions to Hugging Face Jobs. GitHub remains the trigger and status interface, while specialised hardware runs externally. Hugging Face Jobs can run GPU and CPU tasks from GitHub workflows.

Ideas

  • CI orchestration and the actual compute environment can be scaled separately.
  • External jobs need clear feedback on status, logs and artefacts.

Insights

  • Outsourced computing work remains part of the supply chain and needs the same controls as local CI.

Facts

  • Authentication and job invocation are stored in the CI configuration.

Critique

  • Outsourcing extends the chain of trust, cost control and failure surface of the CI.

Recommendations

  • Limit tokens, pin images and test aborts and the return of artefacts for failed jobs.

References

Read the original article on Hugging Face

Search the Web Archive

HF · 2026

Security incident at Hugging Face in July 2026

Hugging Face describes a break-in in which an autonomous agent combined a prepared data source with insecure execution paths. Internal data sets and credentials were reached; according to what was known at the time, public Hub artefacts were not manipulated. The attack combined a malicious data set with remote code execution and template injection.

HF · 2026

GGML and llama.cpp join Hugging Face

GGML and llama.cpp become part of Hugging Face to develop local inference and open model formats further in the long term. The collaboration ties the Hub more closely to CPU and edge execution. GGML forms the technical basis of many quantised local models.

HF · 2025

Xet has arrived on the Hugging Face Hub

The Hub activates Xet as the storage layer for model and data set artefacts. Users keep Git-like workflows, while transfer and deduplication happen at block level. Xet is gradually replacing Git LFS as the storage path for large Hub files.