feat(cli): pin Hugging Face revisions on remote-uploads create

[nbroad1881]

Summary

• CreateRemoteUpload has no revision field; hermes pins Hugging Face sources via @<commit|tag|branch> on the remote URL.
• Add --revision to tg beta models remote-uploads create so callers can pin a commit, tag, or branch without encoding it by hand.
• Reject conflicting @… / --revision values and --revision on non-Hugging Face sources (presigned archives).

Test plan

• uv run pytest tests/cli/test_beta_models.py::TestBetaModelsRemoteUploads
• tg beta models remote-uploads create <model-id> --from https://huggingface.co/org/model --revision <sha>
• Confirm a conflicting --from …@rev-a --revision rev-b fails
• Confirm --revision is rejected for a presigned S3/GCS URL

[broly-code-security-scanner]

Broly Security Scan

Caution

⚠️ 4 file(s) not yet AI-analyzed — re-analysis in progress, this comment will update

Note

Summary

5 actionable finding(s) in this PR

• 🟠 5 high

All actionable items are in the table below.

Severity	Scanner	Issue	Location	Dismiss	Verdict
🟠 HIGH	SAST	Weak hash (MD5)	tests/cli/test_beta_models.py:58	d1	⚠️ Not verified
🟠 HIGH	SAST	Weak hash (MD5)	tests/cli/test_beta_models.py:707	d2	⚠️ Not verified
🟠 HIGH	SAST	Weak hash (MD5)	tests/cli/test_beta_models.py:720	d3	⚠️ Not verified
🟠 HIGH	SAST	Weak hash (MD5)	tests/cli/test_beta_models.py:769	d4	⚠️ Not verified
🟠 HIGH	SAST	Weak hash (MD5)	tests/cli/test_beta_models.py:797	d5	⚠️ Not verified

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

• d1 · 🟠 HIGH     · tests/cli/test_beta_models.py:58 · Weak hash (MD5)
• d2 · 🟠 HIGH     · tests/cli/test_beta_models.py:707 · Weak hash (MD5)
• d3 · 🟠 HIGH     · tests/cli/test_beta_models.py:720 · Weak hash (MD5)
• d4 · 🟠 HIGH     · tests/cli/test_beta_models.py:769 · Weak hash (MD5)
• d5 · 🟠 HIGH     · tests/cli/test_beta_models.py:797 · Weak hash (MD5)

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.3-Flash) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.

 

[blainekasten]

@nbroad1881 if I'm understanding this correctly - this is more of a nice to have than a new feature because you can use embed the revision in the URL you pass to --from right? Why do you think we need this then?