ci: avoid anonymous Hermes source fetches

[AjayThorve]

Overview

Replace anonymous Hermes Agent fetches in GitHub Actions with authenticated, commit-pinned secondary checkouts. This prevents the Python, wheel, pre-commit, and Fern preview jobs from independently hitting GitHub's anonymous Git rate limit while preserving the existing local installation workflow.

Details

• Check out NousResearch/hermes-agent at the Fabric-pinned commit with the existing full-SHA-pinned actions/checkout action.
• Place the source at the editable path already declared by Fabric: external/hermes-agent.
• Teach just install-hermes-agent to validate the current HEAD and skip git fetch when CI has already supplied the exact pinned commit.
• Retain the existing shallow-fetch fallback for local development when the checkout is missing or points at another commit.
• Continue using uv sync and its existing lockfile-backed cache for installation.

Validation

• just --fmt --check
• git diff --check
• pre-commit run copyright-header --files .github/workflows/ci_check.yml .github/workflows/ci_python.yml .github/workflows/fern-docs.yml justfile
• pre-commit run actionlint --all-files
• Focused mocked recipe validation proving that an exact pinned checkout skips git fetch and a mismatched checkout retains the fetch-and-checkout fallback

The full Python matrix was not run locally because no Python or product behavior changed; the pull request's ordinary GitHub Actions jobs provide the end-to-end checkout and installation validation. NVSkills was not invoked.

Where should the reviewer start?

Start with justfile and then compare the secondary checkout in .github/workflows/ci_python.yml with the existing Hermes installation step.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Relates to: none

• I confirm this contribution is my own work, or I have the right to submit it under this project's license.

• I searched existing issues and open pull requests, and this does not duplicate existing work.

Summary by CodeRabbit

• Chores
  • Improved automated setup for the pinned Hermes Agent component across testing, build, and documentation workflows.
  • Reduced unnecessary repository updates when the required Hermes Agent version is already available.
  • Ensured consistent Hermes Agent availability during CI checks, package builds, and documentation previews.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: c11ce81b-a37b-4846-b4ff-91f846714f7e

📥 Commits

Reviewing files that changed from the base of the PR and between 76de2cd and 85a62f4.

📒 Files selected for processing (4)

• .github/workflows/ci_check.yml
• .github/workflows/ci_python.yml
• .github/workflows/fern-docs.yml
• justfile

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (18)

• GitHub Check: Preview docs
• GitHub Check: Test (Python 3.12, macos-arm64)
• GitHub Check: Test (Python 3.12, linux-arm64)
• GitHub Check: Test (Python 3.14, linux-amd64)
• GitHub Check: Test (Python 3.11, linux-arm64)
• GitHub Check: Test (Python 3.13, macos-arm64)
• GitHub Check: Test (Python 3.12, linux-amd64)
• GitHub Check: Test (Python 3.12, windows-amd64)
• GitHub Check: Test (Python 3.13, linux-amd64)
• GitHub Check: Test (Python 3.14, macos-arm64)
• GitHub Check: Test (Python 3.13, windows-amd64)
• GitHub Check: Test (Python 3.14, linux-arm64)
• GitHub Check: Test (Python 3.13, linux-arm64)
• GitHub Check: Test (Python 3.11, macos-arm64)
• GitHub Check: Test (Python 3.11, windows-amd64)
• GitHub Check: Test (Python 3.14, windows-amd64)
• GitHub Check: Test (Python 3.11, linux-amd64)
• GitHub Check: Pre-commit

🧰 Additional context used

📓 Path-based instructions (13)

Put `permissions:` on each job that needs token access.

📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)

Files:

• .github/workflows/ci_check.yml
• .github/workflows/fern-docs.yml
• .github/workflows/ci_python.yml

Every external action is pinned to a full SHA

📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)

Files:

• .github/workflows/ci_check.yml
• .github/workflows/fern-docs.yml
• .github/workflows/ci_python.yml

- Blind repository-wide replacement of version-like strings.

📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)

Files:

• justfile

- Format changed files with the language-native formatter before the final

📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)

Files:

• justfile

Draft release notes only from verified repository evidence; verify each candidate claim against changed public documentation, API types, command help, or source before publication.

📄 CodeRabbit inference engine (.agents/skills/draft-release-notes/SKILL.md)

Files:

• justfile

Keep pull request branch scope coherent and reviewable.

📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)

Files:

• justfile

Package names, import paths, and module names are internally consistent

📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)

Files:

• justfile

Add the package to the root adapter-test dependency group,

📄 CodeRabbit inference engine (.agents/skills/contribute-adapter/SKILL.md)

Files:

• justfile

just --fmt --check

📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)

Files:

• justfile

Always spell `NVIDIA` in all caps; do not use `Nvidia`, `nvidia`, `nVidia`, `nVIDIA`, or `NV`.

📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)

Files:

• justfile

Before implementing, explicitly state assumptions, surface ambiguity and tradeoffs, present multiple interpretations when relevant, and ask for clarification rather than silently deciding or proceeding when requirements are unclear.

📄 CodeRabbit inference engine (.agents/skills/karpathy-guidelines/SKILL.md)

Files:

• justfile

Keep the tiers separate: do not add external integration guidance to the

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• justfile

Reproduce or identify the failing behavior before making a small NeMo Fabric bug fix.

📄 CodeRabbit inference engine (.agents/skills/small-fix/SKILL.md)

Files:

• justfile

🪛 zizmor (1.29.0)

.github/workflows/ci_check.yml

[warning] 4-81: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

.github/workflows/fern-docs.yml

[warning] 4-439: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

.github/workflows/ci_python.yml

[warning] 4-203: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

🔇 Additional comments (5)

.github/workflows/ci_check.yml (1)

32-38: LGTM!

.github/workflows/ci_python.yml (2)

71-79: LGTM!

---

149-156: LGTM!

.github/workflows/fern-docs.yml (1)

74-80: LGTM!

justfile (1)

369-373: LGTM!

---

Walkthrough

The workflows now check out a pinned Hermes Agent repository for CI, wheel builds, and documentation. The installation command checks the current commit and updates the checkout only when required.

Changes

Hermes Agent checkout

Layer / File(s)	Summary
Workflow Hermes Agent provisioning .github/workflows/ci_check.yml, .github/workflows/ci_python.yml, .github/workflows/fern-docs.yml	The workflows check out the pinned NousResearch/hermes-agent repository under the required external paths. Credentials persistence is disabled.
Conditional local checkout synchronization justfile	install-hermes-agent compares the current checkout HEAD with the pinned commit and fetches and checks out the commit only when they differ.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 85a62

This change replaces anonymous Hermes source fetches in CI with pinned checkouts and preserves the local fallback behavior; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the allowed lowercase type ci, follows Conventional Commits format, provides a concise imperative summary, and is under 72 characters without a trailing period.
Description check	✅ Passed	The description includes an overview, reviewer starting point, related-issues section with an allowed action keyword, validation details, and both required confirmation checkboxes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Fern docs preview: https://nvidia-preview-pull-request-264.docs.buildwithfern.com/nemo/fabric

[AjayThorve]

/merge