Add live Slack notifications to release workflow by Wauplin · Pull Request #4046 · huggingface/huggingface_hub

Wauplin · 2026-04-03T12:30:39Z

Note from myself: follow-up on the on-going work to streamline `huggingface_hub` releases. This PR adds a Slack Bot that will send messages to `#hub-client-library-internal` with status of each step. This will make it more straightforward to retrieve URLs and generated messages.

I have added SLACK_BOT_TOKEN as a secret and SLACK_CHANNEL_ID as a variable in this repo settings.

Bot will be this one: https://api.slack.com/apps/A0AQJJYFFBM/general

Summary

Posts a Slack message when a release starts (with type emoji: 🏗️ pre-release, 🚢 release, 🐛 patch)
Each sub-job posts a threaded reply on completion with ✅/❌ status and relevant links:
- PyPI → links to huggingface-hub / hf history
- Release notes → links to GitHub releases page
- Slack announcement → uploads the generated .md file as a thread attachment
- Downstream testing → links to compare URL per repo (transformers, datasets, diffusers, sentence-transformers)
- Post-release → links to the version bump PR
- CLI skill sync → status
A final slack-complete job updates the original message ("started" → "completed"/"failed") and adds a ✅ or ❌ reaction
All Slack steps use continue-on-error: true — Slack issues never block the release
Skipped during dry runs and when message_ts is empty (Slack init failed)

Setup required

Secret SLACK_BOT_TOKEN — Slack Bot User OAuth Token with scopes: chat:write, reactions:write, files:write
Repository variable SLACK_CHANNEL_ID — target Slack channel ID
Invite the bot to the channel

🤖 Generated with Claude Code

Note

Medium Risk
Modifies the release GitHub Actions workflow to add Slack messaging and a new completion job; while Slack steps are non-blocking, changes touch the release pipeline and could affect execution flow/needs outputs if misconfigured.

Overview
Adds live Slack notifications to the release.yml workflow: the prepare job now posts a “release started” message and exports its message_ts for threading.

Each major job (PyPI publishes, release notes, prerelease Slack announcement generation incl. file upload, downstream RC branches, post-release bump PR, and CLI skill sync) posts a ✅/❌ threaded status update, and a new slack-complete job updates the original message with final success/failure plus a reaction. The post-release step also captures the created PR URL for linking in Slack, and the workflow docs now list required Slack secret/variable.

^{Written by Cursor Bugbot for commit 91d22cd. This will update automatically on new commits. Configure here.}

Post a single message to Slack when a release starts, then update it with threaded replies as each sub-job completes (PyPI publish, release notes, downstream testing, post-release PR, CLI skill sync). A final job updates the original message with overall success/failure status and adds an emoji reaction. Each thread reply includes relevant links (PyPI history, GitHub releases, downstream compare URLs, PR links). The Slack announcement file is uploaded as a thread attachment. All Slack steps use continue-on-error so failures never block the release. Notifications are skipped during dry runs. Requires: SLACK_BOT_TOKEN secret (chat:write, reactions:write, files:write scopes) and SLACK_CHANNEL_ID repository variable. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

bot-ci-comment · 2026-04-03T12:36:19Z

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

- Include needs.prepare.result in the failure detection loop. If prepare fails after posting the Slack message (e.g. during git push), message_ts is set but nothing was published — without this check, the final message would incorrectly report success. - Add continue-on-error: true to match every other Slack step, so a Slack API failure doesn't cause the workflow to report as failed. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

In bash double quotes, \n is a literal backslash + n, not a newline. When passed through jq --arg, Slack receives the two-character string \n instead of a newline, breaking the block quote rendering. Use $'\n' concatenation to inject a real newline character. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

hanouticelina

conceptually looks good to me ✅

paulinebm · 2026-04-08T20:19:40Z

      - name: Install dependencies
        run: pip install PyGithub

      - name: Install OpenCode


it will be nice to check the version installed before and verify hash/checksum to avoid supply chain attack

paulinebm · 2026-04-08T20:22:52Z

  pull-requests: write

 jobs:
  # ============================================================


permissions:
contents: write

paulinebm · 2026-04-08T20:24:45Z

  # ============================================================
  # 2. PUBLISH — PyPI (huggingface_hub)
  # ============================================================
  publish-pypi:


probably enough
permissions:
contents: read

paulinebm · 2026-04-08T20:25:18Z

  # 3. PUBLISH — PyPI (hf CLI)
  # ============================================================
  publish-hf-cli:
    needs: prepare


probably enough
permissions:
contents: read

paulinebm · 2026-04-08T20:25:45Z

  #                        to the final version (removing prerelease flag).
  # ============================================================
  release-notes:
    needs: prepare


probably enough
permissions:
contents: write

paulinebm · 2026-04-08T20:26:16Z

  # 4b. SLACK MESSAGE — generate Slack announcement for prereleases
  # ============================================================
  slack-message:
    needs: [prepare, release-notes]


permissions: contents: read

paulinebm · 2026-04-08T20:26:36Z

  # 5. DOWNSTREAM TESTING — test RC in transformers, datasets, etc.
  # ============================================================
  test-downstream:
    needs: [prepare, publish-pypi]


permissions: contents: read

paulinebm · 2026-04-08T20:27:43Z

  # ============================================================
  # 6. POST-RELEASE — open PR to bump main to next dev version
  # ============================================================
  post-release:


permissions: contents: none ? due to github app (to verify)

paulinebm · 2026-04-08T20:28:03Z

  # ============================================================
  # 7. SYNC HF CLI SKILL — update skill docs in skills repo
  # ============================================================
  sync-hf-cli-skill:


permissions: contents: read

paulinebm · 2026-04-08T20:30:36Z


 permissions:
  contents: write
  pull-requests: write


permissions:
contents: write => better to remove from here and add separately on each job (read or write)
pull-requests: write +> IMO not needed

permissions: {}

Apply least-privilege permissions per job instead of broad top-level write access. Pin OpenCode install to a specific version. Move workflow inputs to env blocks to prevent script injection. Addresses security review from paulinebm in #4046. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Wauplin · 2026-04-09T08:14:01Z

@paulinebm I have addressed all the security issues you've mentioned in a separate PR: #4072

* Harden release workflow permissions and inputs Apply least-privilege permissions per job instead of broad top-level write access. Pin OpenCode install to a specific version. Move workflow inputs to env blocks to prevent script injection. Addresses security review from paulinebm in #4046. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Verify OpenCode binary checksum after install Use repository variables OPENCODE_VERSION and OPENCODE_SHA256 to pin the version and verify the binary integrity via sha256sum. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

Wauplin requested review from hanouticelina and paulinebm April 3, 2026 12:35

Wauplin added 2 commits April 3, 2026 14:38

emojis

c31ab3d

remove rocket reaction

9913c24

Wauplin marked this pull request as ready for review April 3, 2026 12:49

cursor Bot reviewed Apr 3, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

Comment thread .github/workflows/release.yml

cursor Bot reviewed Apr 3, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

hanouticelina approved these changes Apr 8, 2026

View reviewed changes

paulinebm reviewed Apr 8, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

paulinebm reviewed Apr 8, 2026

View reviewed changes

Wauplin mentioned this pull request Apr 9, 2026

[CI] Harden release workflow permissions and inputs #4072

Merged

Wauplin merged commit 3a8ee52 into main Apr 9, 2026
19 of 21 checks passed

Wauplin deleted the release-slack-notifications branch April 9, 2026 08:22

Conversation

Wauplin commented Apr 3, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Note from myself: follow-up on the on-going work to streamline huggingface_hub releases. This PR adds a Slack Bot that will send messages to #hub-client-library-internal with status of each step. This will make it more straightforward to retrieve URLs and generated messages.

Summary

Setup required

Uh oh!

bot-ci-comment Bot commented Apr 3, 2026

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hanouticelina left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Wauplin commented Apr 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Wauplin commented Apr 3, 2026 •

edited by cursor Bot

Loading

Note from myself: follow-up on the on-going work to streamline `huggingface_hub` releases. This PR adds a Slack Bot that will send messages to `#hub-client-library-internal` with status of each step. This will make it more straightforward to retrieve URLs and generated messages.