[MaxGhenis]

Summary

Both Modal deploys copied the org-wide HUGGING_FACE_TOKEN Actions secret into the runtime's Modal secret: production (deploy.yml, into policyengine-uk-chat-secrets) and previews (pr-beta-deploy.yml). That org secret holds an individual's personal, long-lived Hugging Face token with write access, which every repository in the org can read. It is being retired. This PR moves both deploys to a dedicated repository secret, HF_RUNTIME_READ_TOKEN, meant to hold a read-only token for policyengine/policyengine-uk-data-private.

• The runtime keeps reading HUGGING_FACE_TOKEN; only where the deploy gets the value changes.
• A Modal secret outlives the run that writes it, so it cannot use a one-hour OIDC token: it needs a stored one.
• sync-modal-secret.sh now refuses to write the Modal secret when HUGGING_FACE_TOKEN is empty, and its error names HF_RUNTIME_READ_TOKEN. That way a deploy cannot ship a runtime without data access.
• backend/tests/test_modal_app.py pins the new wiring and checks that no workflow reads the org secret, in dotted or bracket form. It also runs the sync script with the token missing and empty, and checks that the script exits non-zero, names HF_RUNTIME_READ_TOKEN, and never calls Modal.

Effect today

None at runtime. deploy.yml is disabled, and the preview deploy job is if: false, so neither runs. HF_RUNTIME_READ_TOKEN is not set yet. If either deploy is switched back on before it is, the secret sync stops with that message. In production, that happens before the migration and the deploy run. A re-enabled preview job stops its stale backend preview first (pr-beta-deploy.yml, "Stop stale backend preview"), so that preview would be down until the secret is set. The guard only checks that a value is present: a wrong token would still get through. The Modal secrets already written (production policyengine-uk-chat-secrets and any preview secrets) still hold the value they were last synced with. They stop working when that token is revoked, and are replaced on the next deploy after this lands.

Verification

• pytest backend/tests/test_modal_app.py: 28 passed (minimal Python 3.13 environment with pytest and PyYAML). With the guard commented out, both new guard tests fail.
• An independent review (GPT-6.1 Sol) approved head 3fed478. It noted that the guard test checked only the text, which the new behavioural tests cover, and that the half-deployed wording was overstated, which is now corrected.
• actionlint on both workflows is clean, and bash -n passes on the sync script.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
policyengine-uk-chat	Ready	Preview	Oct 14, 2026 4:50pm UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.11%. Comparing base (b624984) to head (1709e12).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #290      +/-   ##
==========================================
+ Coverage   74.04%   75.11%   +1.07%     
==========================================
  Files         153      155       +2     
  Lines       11769    11889     +120     
  Branches     2010     2041      +31     
==========================================
+ Hits         8714     8931     +217     
+ Misses       2313     2202     -111     
- Partials      742      756      +14     

Flag	Coverage Δ
backend	82.18% <ø> (+1.19%)	⬆️
frontend	37.46% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 10 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.