ci: support Hugging Face token for action smoke

Author: ithiria894

.github/workflows/intentprobe-action-smoke.yml

@@ -30,6 +30,7 @@ jobs:
           paths: |
             research/fixtures/scan_path/safe-weather-package
           fail-on: block
+          hf-token: ${{ secrets.HF_TOKEN }}
 
       - name: Poisoned fixture blocks
         id: poisoned
@@ -40,6 +41,7 @@ jobs:
             research/fixtures/scan_path/poisoned-skill
           fail-on: block
           local-files-only: "true"
+          hf-token: ${{ secrets.HF_TOKEN }}
 
       - name: Assert poisoned fixture was blocked
         if: steps.poisoned.outcome != 'failure'

action.yml

@@ -39,6 +39,10 @@ inputs:
     description: Set true to require the model to already exist in the runner cache.
     required: false
     default: "false"
+  hf-token:
+    description: Optional Hugging Face token used to avoid anonymous CI rate limits.
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -56,6 +60,19 @@ runs:
           ~/.cache/torch
         key: ${{ runner.os }}-intentprobe-${{ inputs.intentprobe-version }}-qwen25-05b-v1
 
+    - name: Configure optional Hugging Face token
+      shell: bash
+      env:
+        INPUT_HF_TOKEN: ${{ inputs.hf-token }}
+      run: |
+        set -euo pipefail
+        if [ -n "$INPUT_HF_TOKEN" ]; then
+          {
+            printf 'HF_TOKEN=%s\n' "$INPUT_HF_TOKEN"
+            printf 'HUGGING_FACE_HUB_TOKEN=%s\n' "$INPUT_HF_TOKEN"
+          } >> "$GITHUB_ENV"
+        fi
+
     - name: Install IntentProbe
       shell: bash
       run: |

docs/DEMO_SCRIPT.md

@@ -55,6 +55,7 @@ jobs:
           paths: |
             .
           fail-on: block
+          hf-token: ${{ secrets.HF_TOKEN }}
 ```
 
 For a narrower scan:
@@ -76,6 +77,8 @@ For a narrower scan:
 - The same scanner can run as a GitHub Action gate before a pull request
   merges.
 - Scan targets and results stay inside the local machine or GitHub runner.
+- CI can pass an optional Hugging Face secret so first-run model downloads do
+  not depend on anonymous rate limits.
 
 ## What this does not prove
 

docs/GITHUB_ACTION.md

@@ -31,6 +31,7 @@ jobs:
           paths: |
             .
           fail-on: block
+          hf-token: ${{ secrets.HF_TOKEN }}
 ```
 
 Use `paths` to narrow the scan once you know where your agent tooling lives:
@@ -45,6 +46,7 @@ Use `paths` to narrow the scan once you know where your agent tooling lives:
             skills/**
             packages/**/package.json
           fail-on: block
+          hf-token: ${{ secrets.HF_TOKEN }}
 ```
 
 ## Inputs
@@ -59,6 +61,14 @@ Use `paths` to narrow the scan once you know where your agent tooling lives:
 | `max-files` | `200` | Maximum candidate files read under each scanned directory. |
 | `max-file-bytes` | `200000` | Maximum bytes read from each candidate file. |
 | `local-files-only` | `false` | Set `true` only when the runner cache already has the model. |
+| `hf-token` | empty | Optional Hugging Face token passed as a GitHub secret to avoid anonymous download rate limits. |
+
+## Optional Hugging Face token
+
+The scanner runs locally in the GitHub Actions runner, but the first
+model-backed scan downloads Qwen2.5-0.5B from Hugging Face. Public runners can
+hit anonymous rate limits, so CI workflows should add an `HF_TOKEN` repository
+secret and pass it with `hf-token: ${{ secrets.HF_TOKEN }}`.
 
 ## What gets uploaded?
 

docs/V0_2_DEMO_PACK.md

@@ -34,6 +34,8 @@ Done:
   landscape.
 - GitHub Action metadata and workflow docs added for CI gating.
 - No-video demo script added for copy-paste CLI and Action proof.
+- Action supports an optional Hugging Face token secret for reliable first-run
+  model downloads in CI.
 
 Not done yet:
 
@@ -49,7 +51,7 @@ Not done yet:
 | Milestone | Status | Evidence target |
 |---|---|---|
 | M0. One-command install | Done | PyPI package installs and scans locally. |
-| M1. CI gate | In progress | `action.yml`, docs, and one green action run. |
+| M1. CI gate | In progress | `action.yml`, docs, optional HF token, and one green action run. |
 | M2. No-video demo | In progress | `docs/DEMO_SCRIPT.md` plus action smoke workflow. |
 | M3. Demo repo | Next | A tiny MCP repo with one safe PR and one poisoned PR. |
 | M4. Runtime receipt demo | Next | `serve-jsonl` demo showing allow/warn/block receipts. |
@@ -159,3 +161,4 @@ Do not say:
 | 2026-06-08 | Build GitHub Action before more posting. | CI turns IntentProbe from "try this CLI" into an admission gate people can wire into repos. |
 | 2026-06-08 | Keep the public pack framed as a demo/evidence pack. | It still serves the acquisition path, but reads better to users, partners, and buyers. |
 | 2026-06-08 | Defer video and prioritize runnable proof. | Security scanner videos are low-signal; action smoke, demo script, and reproducible commands create stronger trust. |
+| 2026-06-08 | Add optional `hf-token` input to the Action. | The first public action smoke hit Hugging Face anonymous rate limits; CI should use a secret without uploading scan content anywhere. |