The third-party action receives HF_TOKEN, so pin it to a commit SHA instead of @main. Add a concurrency group so two merges can't race multi-hour publish jobs against the same Hub repo.
The third-party action receives HF_TOKEN, so pin it to a commit SHA instead of @main. Add a concurrency group so two merges can't race multi-hour publish jobs against the same Hub repo.