File size: 2,820 Bytes
c85bc2e
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
644ba85
 
c85bc2e
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
# Hugging Face Space deploy

Target deployment flow:

```text
Corporate GitLab repository
        ↓ GitLab CI
Private Hugging Face Docker Space
        ↓ CPU Basic / Free
HiveTrace Leaderboard
```

## Hugging Face Space

The Space is created manually once.

Recommended settings:

- Visibility: `Private`
- SDK: `Docker`
- Hardware: `CPU Basic` / free
- App port: `5173`

The project `README.md` already contains the Space frontmatter:

```yaml
---
title: HiveTrace Leaderboard
emoji: 🛡️
colorFrom: green
colorTo: indigo
sdk: docker
app_port: 5173
pinned: true
---
```

## Runtime secrets and variables in Hugging Face

Add the runtime secret in Space Settings:

```text
HF_TOKEN=hf_...
```

This token is required by the app to read the private Hugging Face bucket. Do not expose it as
a `PUBLIC_*` variable and do not commit it to the repository.

Variables:

```text
HF_BUCKET_ID=hivetrace/leaderboard_frontend_v2
HF_BUCKET_PREFIX=latest
HF_BUCKET_CACHE_TTL_MS=300000
HF_BUCKET_REQUEST_TIMEOUT_MS=60000
HF_BUCKET_REQUEST_RETRIES=2
```

Optional:

```text
HF_BUCKET_ENDPOINT=https://huggingface.co
```

## GitLab CI variables

Add the following CI/CD variables in the corporate GitLab project:

```text
HF_USERNAME=<huggingface-user-or-service-account-name>
HF_SPACE_TOKEN=<huggingface-write-token-for-space-repo>
HF_SPACE_REPO=<namespace>/<space-name>
```

Example:

```text
HF_SPACE_REPO=hivetrace/guard-leaderboard
```

`HF_SPACE_TOKEN` must have write access to the Space repository.

Important: keep `HF_SPACE_TOKEN` and the runtime `HF_TOKEN` used for bucket reads as separate
tokens.

In GitLab, mark `HF_SPACE_TOKEN` as a masked/protected variable.

## Deploy flow

`.gitlab-ci.yml` runs two stages:

1. `validate`
   - `pnpm install --frozen-lockfile`
   - `pnpm check` (generates Paraglide output internally)
   - `pnpm build`

2. `deploy:huggingface`
   - runs only on the `prod` branch
   - pushes the current commit to the private Hugging Face Space repository
   - uses force push because the Hugging Face Space repository is a deploy repository
   - the Space automatically rebuilds the Docker image after the push

## Production branch

Production deployment runs only from the `prod` branch.

Typical flow:

```bash
git checkout prod
git merge main
git push origin prod
```

After the push to `prod`, GitLab CI runs validation and then sends this commit to the `main`
branch of the Hugging Face Space repository.

## Local Docker smoke test

Before the first deployment, it is useful to test the Docker image locally:

```bash
docker build -t hivetrace-leaderboard .
docker run --rm -p 5173:5173 \
  -e HF_TOKEN=hf_... \
  -e HF_BUCKET_ID=hivetrace/leaderboard_frontend_v2 \
  -e HF_BUCKET_PREFIX=latest \
  hivetrace-leaderboard
```

After startup, open:

```text
http://127.0.0.1:5173/
```