From 85a62f47dc8735349f38ccb36d1082cdf7cc5c89 Mon Sep 17 00:00:00 2001
From: Ajay Thorve <athorve@nvidia.com>
Date: Tue, 1 Sep 2026 15:42:58 -0700
Subject: [PATCH] ci: authenticate Hermes source checkout

Signed-off-by: Ajay Thorve <athorve@nvidia.com>
---
 .github/workflows/ci_check.yml  |  8 ++++++++
 .github/workflows/ci_python.yml | 17 +++++++++++++++++
 .github/workflows/fern-docs.yml |  8 ++++++++
 justfile                        |  7 +++++--
 4 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci_check.yml b/.github/workflows/ci_check.yml
index fcdd64975..4e86bfff1 100644
--- a/.github/workflows/ci_check.yml
+++ b/.github/workflows/ci_check.yml
@@ -29,6 +29,14 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Checkout Hermes Agent
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: NousResearch/hermes-agent
+          ref: f80f453ae0679347e38abc917c7f94f717bf96c5
+          path: external/hermes-agent
+          persist-credentials: false
+
       - name: Set up uv
         uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
         with:
diff --git a/.github/workflows/ci_python.yml b/.github/workflows/ci_python.yml
index 1ea4afea3..93c1aa016 100644
--- a/.github/workflows/ci_python.yml
+++ b/.github/workflows/ci_python.yml
@@ -68,6 +68,15 @@ jobs:
           persist-credentials: false
           ref: ${{ inputs.ref || github.sha }}
 
+      - name: Checkout Hermes Agent
+        if: ${{ matrix.python-version != '3.14' }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: NousResearch/hermes-agent
+          ref: f80f453ae0679347e38abc917c7f94f717bf96c5
+          path: external/hermes-agent
+          persist-credentials: false
+
       # Rust is needed both to build the native extension (maturin backend) and
       # because the CLI-backed smokes shell out to `cargo run -p nemo-fabric-cli`.
       - name: Set up Rust
@@ -137,6 +146,14 @@ jobs:
           fetch-depth: 0
           ref: ${{ inputs.ref || github.sha }}
 
+      - name: Checkout Hermes Agent
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: NousResearch/hermes-agent
+          ref: f80f453ae0679347e38abc917c7f94f717bf96c5
+          path: external/hermes-agent
+          persist-credentials: false
+
       - name: Set up Rust
         uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
         with:
diff --git a/.github/workflows/fern-docs.yml b/.github/workflows/fern-docs.yml
index 8127a4091..7d7b369bc 100644
--- a/.github/workflows/fern-docs.yml
+++ b/.github/workflows/fern-docs.yml
@@ -71,6 +71,14 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
+      - name: Checkout Hermes Agent
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: NousResearch/hermes-agent
+          ref: f80f453ae0679347e38abc917c7f94f717bf96c5
+          path: source-checkout/external/hermes-agent
+          persist-credentials: false
+
       - name: Install just
         uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2.77.6
         with:
diff --git a/justfile b/justfile
index 306983a39..1f3489016 100644
--- a/justfile
+++ b/justfile
@@ -366,8 +366,11 @@ install-hermes-agent:
         echo "ERROR: Hermes Agent checkout has tracked changes: $hermes_checkout" >&2
         exit 1
     fi
-    git -C "$hermes_checkout" fetch --depth 1 origin "$hermes_commit"
-    git -C "$hermes_checkout" checkout --quiet --detach FETCH_HEAD
+    hermes_head="$(git -C "$hermes_checkout" rev-parse --verify HEAD 2>/dev/null || true)"
+    if [[ "$hermes_head" != "$hermes_commit" ]]; then
+        git -C "$hermes_checkout" fetch --depth 1 origin "$hermes_commit"
+        git -C "$hermes_checkout" checkout --quiet --detach FETCH_HEAD
+    fi
     uv sync --inexact --reinstall-package hermes-agent
 
 # Build the TypeScript contract and adapter packages using their locked dependencies.