fix(security): remediate workflow vulnerability in .github/workflows/nightly.yml

* fix(ci): log in HF for gated repo in nightly workflows

* fix(ci): add env var

* fix(ci): remove 10 min limit for multi-gpu nightly

.github/workflows/nightly.yml

@@ -119,6 +119,7 @@ jobs:
       HF_LEROBOT_HOME: /home/user_lerobot/.cache/huggingface/lerobot
       TORCH_HOME: /home/user_lerobot/.cache/torch
       TRITON_CACHE_DIR: /home/user_lerobot/.cache/triton
+      HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
     container:
       image: ${{ needs.build-docker-cpu-nightly.outputs.image_tag }} # zizmor: ignore[unpinned-images]
       options: --shm-size "16gb"
@@ -130,6 +131,10 @@ jobs:
         shell: bash
         working-directory: /lerobot
     steps:
+      - name: Login to Hugging Face
+        run: |
+          echo "$HF_USER_TOKEN" | hf auth login --token --add-to-git-credential
+          hf auth whoami
       - name: Run pytest on CPU
         run: pytest tests -vv --maxfail=10
       - name: Run end-to-end tests
@@ -146,6 +151,7 @@ jobs:
       HF_LEROBOT_HOME: /home/user_lerobot/.cache/huggingface/lerobot
       TORCH_HOME: /home/user_lerobot/.cache/torch
       TRITON_CACHE_DIR: /home/user_lerobot/.cache/triton
+      HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
     container:
       image: ${{ needs.build-docker-gpu-nightly.outputs.image_tag }} # zizmor: ignore[unpinned-images]
       options: --gpus all --shm-size "16gb"
@@ -157,6 +163,10 @@ jobs:
         shell: bash
         working-directory: /lerobot
     steps:
+      - name: Login to Hugging Face
+        run: |
+          echo "$HF_USER_TOKEN" | hf auth login --token --add-to-git-credential
+          hf auth whoami
       - name: Run pytest on GPU
         run: pytest tests -vv --maxfail=10
       - name: Run end-to-end tests
@@ -174,6 +184,7 @@ jobs:
       TORCH_HOME: /home/user_lerobot/.cache/torch
       TRITON_CACHE_DIR: /home/user_lerobot/.cache/triton
       CUDA_VISIBLE_DEVICES: "0,1,2,3"
+      HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
     container:
       image: ${{ needs.build-docker-gpu-nightly.outputs.image_tag }} # zizmor: ignore[unpinned-images]
       options: --gpus all --shm-size "16gb"
@@ -185,6 +196,10 @@ jobs:
         shell: bash
         working-directory: /lerobot
     steps:
+      - name: Login to Hugging Face
+        run: |
+          echo "$HF_USER_TOKEN" | hf auth login --token --add-to-git-credential
+          hf auth whoami
       - name: Verify GPU availability
         run: |
           nvidia-smi
@@ -192,5 +207,4 @@ jobs:
 
       - name: Run multi-GPU training tests
       # TODO(Steven): Investigate why motors tests are failing in multi-GPU setup
-        run: pytest tests -vv --maxfail=10 --ignore=tests/motors/
+        run: pytest tests -vv --maxfail=10 --ignore=tests/motors/
-        timeout-minutes: 10

.github/workflows/unbound_deps_tests.yml

@@ -48,6 +48,7 @@ jobs:
       MUJOCO_GL: egl
       HF_HOME: /mnt/cache/.cache/huggingface
       HF_LEROBOT_HOME: /mnt/cache/.cache/huggingface/lerobot
+      HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -79,7 +80,10 @@ jobs:
 
       - name: Install lerobot with all extras
         run: uv sync --extra all # TODO(Steven): Make flash-attn optional
-
+      - name: Login to Hugging Face
+        run: |
+          uv run hf auth login --token "$HF_USER_TOKEN" --add-to-git-credential
+          uv run hf auth whoami
       - name: Run pytest (all extras)
         run: uv run pytest tests -vv
 
@@ -137,6 +141,7 @@ jobs:
       HF_LEROBOT_HOME: /home/user_lerobot/.cache/huggingface/lerobot
       TORCH_HOME: /home/user_lerobot/.cache/torch
       TRITON_CACHE_DIR: /home/user_lerobot/.cache/triton
+      HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
     container:
       image: ${{ needs.build-and-push-docker.outputs.image_tag }} # zizmor: ignore[unpinned-images]
       options: --gpus all --shm-size "16gb"
@@ -148,6 +153,10 @@ jobs:
         shell: bash
         working-directory: /lerobot
     steps:
+      - name: Login to Hugging Face
+        run: |
+          hf auth login --token "$HF_USER_TOKEN" --add-to-git-credential
+          hf auth whoami
       - name: Run pytest on GPU
         run: pytest tests -vv
       - name: Run end-to-end tests