sync: main to stable

.github/workflows/async-upload-test.yml

@@ -39,7 +39,7 @@ jobs:
       run:
         working-directory: jobs/async-upload
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -66,7 +66,7 @@ jobs:
       run:
         working-directory: jobs/async-upload
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -89,7 +89,7 @@ jobs:
         working-directory: jobs/async-upload
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           fetch-depth: 0
       - name: Set up Python

.github/workflows/build-and-push-async-upload.yml

@@ -31,7 +31,7 @@ jobs:
       packages: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.0
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3

.github/workflows/build-and-push-csi-image.yml

@@ -38,7 +38,7 @@ jobs:
         if: github.head_ref == '' && github.ref == 'refs/heads/main'
         run: echo "BUILD_CONTEXT=main" >> $GITHUB_ENV
       # checkout branch
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       # set image version
       - name: Set main-branch environment
         if: env.BUILD_CONTEXT == 'main'

.github/workflows/build-and-push-image.yml

@@ -42,7 +42,7 @@ jobs:
         if: github.head_ref == '' && github.ref == 'refs/heads/main'
         run: echo "BUILD_CONTEXT=main" >> $GITHUB_ENV
       # checkout branch
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       # Set up QEMU for multi-architecture builds
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3

.github/workflows/build-and-push-ui-images-standalone.yml

@@ -29,7 +29,7 @@ jobs:
       packages: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.0
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3

.github/workflows/build-and-push-ui-images.yml

@@ -29,7 +29,7 @@ jobs:
       packages: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.0
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3

.github/workflows/build-image-pr.yml

@@ -25,7 +25,7 @@ jobs:
   build-and-test-image:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       - name: Generate Tag
         shell: bash
         id: tags

.github/workflows/build-image-ui-pr.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # checkout branch
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       - name: Build UI Image
         shell: bash
         run: ./scripts/build_deploy.sh

.github/workflows/build.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
       - name: Setup Go
         uses: actions/setup-go@v6
         with:

.github/workflows/check-db-schema-structs.yaml

@@ -14,7 +14,7 @@ jobs:
   check-mysql-schema-structs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
@@ -34,7 +34,7 @@ jobs:
   check-postgres-schema-structs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       - name: Setup Go
         uses: actions/setup-go@v6
         with:

.github/workflows/check-gitattributes.yaml

@@ -8,6 +8,6 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       - name: Validate OpenAPI spec
         run: ./scripts/gen_gitattributes.sh --check

.github/workflows/check-openapi-spec-pr.yaml

@@ -12,7 +12,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       - name: Validate OpenAPI spec
         run: |
           make openapi/validate

.github/workflows/controller-test.yml

@@ -39,7 +39,7 @@ jobs:
           echo "tag=${tag}" >> $GITHUB_OUTPUT
 
       - name: Clone the code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Setup Go
         uses: actions/setup-go@v6

.github/workflows/csi-test.yml

@@ -35,7 +35,7 @@ jobs:
   build-and-test-csi-image:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
 
       - name: Generate tag
         shell: bash

.github/workflows/first-time-contributor-pr.yml

@@ -15,13 +15,14 @@ permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule Token
 
 jobs:
   welcome:
+    if: ${{ github.actor != 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Install PyYAML
         run: pip3 install pyyaml

.github/workflows/go-mod-tidy-diff-check.yml

@@ -16,7 +16,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@v6.0.0
 
             - name: Set up Go
               uses: actions/setup-go@v6

.github/workflows/prepare.yml

@@ -8,7 +8,7 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
       - name: Setup Go
         uses: actions/setup-go@v6
         with:

.github/workflows/python-release.yml

@@ -16,7 +16,7 @@ jobs:
       FORCE_COLOR: "1"
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           fetch-depth: 0
       - name: Set up Python

.github/workflows/python-tests.yml

@@ -31,7 +31,7 @@ jobs:
       FORCE_COLOR: "1"
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
       - name: Set up Python ${{ matrix.python }}
         uses: actions/setup-python@v6
         with:
@@ -74,7 +74,7 @@ jobs:
         nodejs: ["20"]
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           fetch-depth: 0
       - name: Set up Python
@@ -148,7 +148,7 @@ jobs:
       DEPLOY_MANIFEST_DB: "${{ matrix.manifest-db }}"
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
       - name: Set up Python ${{ matrix.python }}
         uses: actions/setup-python@v6
         with:
@@ -227,7 +227,7 @@ jobs:
         run: |
           kubectl port-forward -n ${{ env.MR_NAMESPACE }} service/model-registry-service 8080:8080 &
           kubectl port-forward -n minio svc/minio 9000:9000 &
-          kubectl port-forward service/distribution-registry-test-service 5001:5001 &
+          kubectl port-forward service/distribution-registry-test-service -n local-oci-registry-ns 5001:5001 &
           sleep 2
           nox --python=${{ matrix.python }} --session=e2e -- --cov-report=xml
       - name: Upload coverage report # we upload coverage stats for py once, regardless if previous step failed
@@ -251,7 +251,7 @@ jobs:
         run: |
           kubectl port-forward -n ${{ env.MR_NAMESPACE }} service/model-registry-service 8080:8080 > /dev/null 2>&1 &
           kubectl port-forward -n minio svc/minio 9000:9000 > /dev/null 2>&1 &
-          kubectl port-forward service/distribution-registry-test-service 5001:5001 > /dev/null 2>&1 &
+          kubectl port-forward service/distribution-registry-test-service -n local-oci-registry-ns 5001:5001 > /dev/null 2>&1 &
           sleep 2
           nox --python=${{ matrix.python }} --session=fuzz
 
@@ -268,7 +268,7 @@ jobs:
       FORCE_COLOR: "1"
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
       - name: Set up Python ${{ matrix.python }}
         uses: actions/setup-python@v6
         with:

.github/workflows/scorecard.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.0
+        uses: actions/checkout@v6.0.0 # unify for Dependabot bump
         with:
           persist-credentials: false
 

.github/workflows/test-fuzz.yml

@@ -53,7 +53,7 @@ jobs:
             }
 
       - name: Checkout PR
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
         with:
           ref: ${{ fromJson(steps.pr.outputs.result).sha }}
 

.github/workflows/trivy-image-scanning.yaml

@@ -24,7 +24,7 @@ jobs:
         ]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       - name: Sanitize image name for SARIF filename
         run: |

.github/workflows/ui-bff-build.yml

@@ -26,7 +26,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
 
       - name: Setup Go
         uses: actions/setup-go@v6

.github/workflows/ui-frontend-build.yml

@@ -26,7 +26,7 @@ jobs:
   test-and-build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.0
 
       - name: Set up Node.js
         uses: actions/setup-node@v6

catalog/README.md

@@ -13,6 +13,7 @@ The catalog service operates as a **metadata aggregation layer** that:
 ### Supported Catalog Sources
 
 - **YAML Catalog** - Static YAML files containing model metadata
+- **HuggingFace Hub** - Discover models from HuggingFace's model repository
 
 ## REST API
 
@@ -75,6 +76,76 @@ catalogs:
       path: "./models"
 ```
 
+### HuggingFace Source Configuration
+
+The HuggingFace catalog source allows you to discover and import models from the HuggingFace Hub. To configure a HuggingFace source:
+
+#### 1. Set Your API Key
+
+The HuggingFace provider requires an API key for authentication. By default, the service reads the API key from the `HF_API_KEY` environment variable:
+
+```bash
+export HF_API_KEY="your-huggingface-api-key-here"
+```
+
+**Getting a HuggingFace API Key:**
+1. Sign up or log in to [HuggingFace](https://huggingface.co)
+2. Go to your [Settings > Access Tokens](https://huggingface.co/settings/tokens)
+3. Create a new token with "Read" permissions
+4. Copy the token and set it as an environment variable
+
+**For Kubernetes deployments:**
+- Store the API key in a Kubernetes Secret
+- Reference it in your deployment configuration
+- The catalog service will read it from the configured environment variable (defaults to `HF_API_KEY`)
+
+**Custom Environment Variable Name:**
+You can configure a custom environment variable name per source by setting the `apiKeyEnvVar` property in your source configuration (see below). This is useful when you need different API keys for different sources.
+
+**Important Notes:**
+- **Private Models**: For private models, the API key must belong to an account that has been granted access to the model. Without proper access, the catalog service will not be able to retrieve model information.
+- **Gated Models**: For gated models (models with usage restrictions), you must accept the model's terms of service on HuggingFace before the catalog service can access all available model information. Visit the model's page on HuggingFace and accept the terms to ensure full metadata is available.
+
+#### 2. Configure the Source
+
+Add a HuggingFace source to your `catalog-sources.yaml`:
+
+```yaml
+catalogs:
+  - name: "HuggingFace Hub"
+    id: "huggingface"
+    type: "hf"
+    enabled: true
+    # Required: List of model identifiers to include
+    # Format: "organization/model-name" or "username/model-name"
+    includedModels:
+      - "meta-llama/Llama-3.1-8B-Instruct"
+      - "ibm-granite/granite-4.0-h-small"
+      - "microsoft/phi-2"
+
+    # Optional: Exclude specific models or patterns
+    # Supports exact matches or patterns ending with "*"
+    excludedModels:
+      - "some-org/unwanted-model"
+      - "another-org/test-*"  # Excludes all models starting with "test-"
+
+    # Optional: Configure a custom environment variable name for the API key
+    # Defaults to "HF_API_KEY" if not specified
+    properties:
+      apiKeyEnvVar: "MY_CUSTOM_API_KEY_VAR"
+```
+
+#### Model Filtering
+
+Both `includedModels` and `excludedModels` are top-level properties (not nested under `properties`):
+
+- **`includedModels`** (required): List of model identifiers to fetch from HuggingFace. Format: `"organization/model-name"` or `"username/model-name"`
+- **`excludedModels`** (optional): List of models or patterns to exclude from the results
+
+The `excludedModels` property supports:
+- **Exact matches**: `"meta-llama/Llama-3.1-8B-Instruct"` - excludes this specific model
+- **Pattern matching**: `"test-*"` - excludes all models starting with "test-"
+
 ## Development
 
 ### Prerequisites