Deploy simready-assets run 20261005-ee37df6 (GPU variant)

pipeline/artifact_store.py

@@ -33,6 +33,12 @@ from .config import Config
 
 ARTIFACT_AWS_ACCESS_KEY_ID_VAR = "SIMREADYCENTRAL_INDEX_STORE_AWS_ACCESS_KEY_ID"
 ARTIFACT_AWS_SECRET_ACCESS_KEY_VAR = "SIMREADYCENTRAL_INDEX_STORE_AWS_SECRET_ACCESS_KEY"
+# A separate read-only IAM user for the HF Spaces: deploy-space* pushes these
+# (never the read-write pair above) as the Space's ARTIFACT_AWS_* secrets, and
+# bake's hf-space smoke tests run the images with them, so a Space never holds
+# keys that can write to or delete from the bucket.
+ARTIFACT_READONLY_AWS_ACCESS_KEY_ID_VAR = "SIMREADYCENTRAL_INDEX_STORE_READONLY_AWS_ACCESS_KEY_ID"
+ARTIFACT_READONLY_AWS_SECRET_ACCESS_KEY_VAR = "SIMREADYCENTRAL_INDEX_STORE_READONLY_AWS_SECRET_ACCESS_KEY_ID"
 
 T = TypeVar("T")
 
@@ -75,6 +81,20 @@ def artifact_env() -> Dict[str, str]:
     return env
 
 
+def space_artifact_secrets() -> Dict[str, str]:
+    """The read-only pair, under the names the HF Space container reads
+    (artifact_env()'s, inside the Space) — what a Space secret or a smoke
+    test's `docker run -e` sets."""
+    key = os.environ.get(ARTIFACT_READONLY_AWS_ACCESS_KEY_ID_VAR, "").strip()
+    secret = os.environ.get(ARTIFACT_READONLY_AWS_SECRET_ACCESS_KEY_VAR, "").strip()
+    if not key or not secret:
+        raise SystemExit(
+            f"{ARTIFACT_READONLY_AWS_ACCESS_KEY_ID_VAR} / {ARTIFACT_READONLY_AWS_SECRET_ACCESS_KEY_VAR} "
+            "must be set in the environment: the HF Space gets the artifact bucket's read-only keys."
+        )
+    return {ARTIFACT_AWS_ACCESS_KEY_ID_VAR: key, ARTIFACT_AWS_SECRET_ACCESS_KEY_VAR: secret}
+
+
 @functools.lru_cache(maxsize=4)
 def _client(region: str, key: str, secret: str):
     return boto3.session.Session(

pipeline/bake.py

@@ -20,7 +20,7 @@ from pathlib import Path
 from typing import Dict, List, Optional
 
 from . import hf_addressing
-from .artifact_store import artifact_env
+from .artifact_store import space_artifact_secrets
 from .config import (
     BUILD_DIR,
     REPO_ROOT,
@@ -568,12 +568,11 @@ def verify_baked(cfg: Config, tags: Dict[str, str], manifest: Dict) -> int:
         # load, not just a process coming up. RESTORE_RUN_ID pins the restore
         # to this run: latest.json may name another one (`upload --no-latest`).
         token = cfg.siglip2_nvcf_env()["SIGLIP2_TRITON_SERVER_AUTH_TOKEN"]
-        aws = artifact_env()
+        aws = space_artifact_secrets()  # the read-only keys the Space itself gets
         result = subprocess.run(
             ["docker", "run", "--rm", "-d", "-p", "17860:7860",
              "-e", f"SIGLIP2_TRITON_SERVER_AUTH_TOKEN={token}",
-             "-e", f"SIMREADYCENTRAL_INDEX_STORE_AWS_ACCESS_KEY_ID={aws['AWS_ACCESS_KEY_ID']}",
-             "-e", f"SIMREADYCENTRAL_INDEX_STORE_AWS_SECRET_ACCESS_KEY={aws['AWS_SECRET_ACCESS_KEY']}",
+             *(flag for key, value in aws.items() for flag in ("-e", f"{key}={value}")),
              "-e", f"RESTORE_RUN_ID={manifest['run_id']}",
              tags["hf_space"]],
             capture_output=True, text=True, check=True, timeout=60,
@@ -674,11 +673,10 @@ def verify_baked(cfg: Config, tags: Dict[str, str], manifest: Dict) -> int:
         # pipeline.md §12) doesn't enable it. No NVCF token needed. AWS keys
         # still are — the index restore path is identical to the NVCF
         # variant's.
-        aws = artifact_env()
+        aws = space_artifact_secrets()  # the read-only keys the Space itself gets
         result = subprocess.run(
             ["docker", "run", "--rm", "-d", "-p", "17861:7860", "--gpus", "all",
-             "-e", f"SIMREADYCENTRAL_INDEX_STORE_AWS_ACCESS_KEY_ID={aws['AWS_ACCESS_KEY_ID']}",
-             "-e", f"SIMREADYCENTRAL_INDEX_STORE_AWS_SECRET_ACCESS_KEY={aws['AWS_SECRET_ACCESS_KEY']}",
+             *(flag for key, value in aws.items() for flag in ("-e", f"{key}={value}")),
              "-e", f"RESTORE_RUN_ID={manifest['run_id']}",
              tags["hf_space_gpu"]],
             capture_output=True, text=True, check=True, timeout=60,

pipeline/hf_space.py

@@ -51,7 +51,7 @@ from typing import Dict, List
 from huggingface_hub import HfApi, SpaceHardware
 from huggingface_hub.errors import HfHubHTTPError
 
-from .artifact_store import artifact_env
+from .artifact_store import space_artifact_secrets
 from .bake import DOCKER_DIR, hf_space_build_args, hf_space_gpu_build_args, image_tags
 from .config import BUILD_DIR, HF_SPACE_GPU_HARDWARE_DEFAULT, REPO_ROOT, Config
 from .corpus import Corpus
@@ -242,7 +242,7 @@ def run(cfg: Config) -> int:
     repo_id = cfg.require("HF_SPACE_REPO_ID")  # e.g. "nvidia/simready-central"
     title = cfg.get("HF_SPACE_TITLE", repo_id.split("/", 1)[-1])
     siglip2_token = cfg.siglip2_nvcf_env()["SIGLIP2_TRITON_SERVER_AUTH_TOKEN"]
-    aws = artifact_env()  # raises if the artifact-bucket keys aren't set
+    aws = space_artifact_secrets()  # raises if the read-only artifact-bucket keys aren't set
 
     print(f"staging Space source at {STAGE_DIR} ...")
     stage_repo(STAGE_DIR, deploy_marker(manifest), README_TEMPLATE.format(title=title))
@@ -264,14 +264,15 @@ def run(cfg: Config) -> int:
         api.add_space_variable(repo_id, key, value)
 
     print("setting runtime secrets ...")
-    # Names must match what pipeline/artifact_store.py's artifact_env() and
+    # Names must match what pipeline/artifact_store.py's artifact_env() (in
+    # the Space; the values are the read-only pair) and
     # config.py's siglip2_nvcf_env() read from the environment — Hugging
     # Face injects Space secrets as plain runtime env vars, so no separate
     # "buildtime" naming/mounting is needed (see hf_space_seed.py's
     # docstring for why this pipeline restores at runtime rather than build
     # time in the first place).
-    api.add_space_secret(repo_id, "SIMREADYCENTRAL_INDEX_STORE_AWS_ACCESS_KEY_ID", aws["AWS_ACCESS_KEY_ID"])
-    api.add_space_secret(repo_id, "SIMREADYCENTRAL_INDEX_STORE_AWS_SECRET_ACCESS_KEY", aws["AWS_SECRET_ACCESS_KEY"])
+    for key, value in aws.items():
+        api.add_space_secret(repo_id, key, value)
     api.add_space_secret(repo_id, "SIGLIP2_TRITON_SERVER_AUTH_TOKEN", siglip2_token)
 
     sync_storage_api_token(api, repo_id)
@@ -332,7 +333,7 @@ def run_gpu(cfg: Config) -> int:
     repo_id = cfg.require("HF_SPACE_REPO_ID_GPU")  # e.g. "nvidia/simready-central-gpu"
     title = cfg.get("HF_SPACE_TITLE_GPU", repo_id.split("/", 1)[-1])
     hardware = cfg.get("HF_SPACE_GPU_HARDWARE", HF_SPACE_GPU_HARDWARE_DEFAULT)
-    aws = artifact_env()  # raises if the artifact-bucket keys aren't set — no NVCF token needed here
+    aws = space_artifact_secrets()  # raises if the read-only keys aren't set — no NVCF token needed here
 
     print(f"staging Space source at {STAGE_DIR_GPU} ...")
     stage_repo(
@@ -362,8 +363,8 @@ def run_gpu(cfg: Config) -> int:
     # No SIGLIP2_TRITON_SERVER_AUTH_TOKEN here — this variant's local
     # siglip2-triton process has no auth in front of it (loopback-only,
     # same as OpenSearch/Neo4j/Redis in this image).
-    api.add_space_secret(repo_id, "SIMREADYCENTRAL_INDEX_STORE_AWS_ACCESS_KEY_ID", aws["AWS_ACCESS_KEY_ID"])
-    api.add_space_secret(repo_id, "SIMREADYCENTRAL_INDEX_STORE_AWS_SECRET_ACCESS_KEY", aws["AWS_SECRET_ACCESS_KEY"])
+    for key, value in aws.items():
+        api.add_space_secret(repo_id, key, value)
 
     sync_storage_api_token(api, repo_id)