fix(ci): update CloudFront test key pair ID after rotation (#3335)

The test CloudFront signing key was rotated on 2026-04-25, deleting
the old K3814DK2QUJ71H key. Update the hardcoded key pair ID to the
new K1MTLUUQ6YN2UZ to fix 403 errors on signed URLs in CI.

Author: rtrompier

.github/workflows/_e2e_tests.yml

@@ -65,7 +65,7 @@ jobs:
           S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
           S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
           S3_REGION_NAME: "us-east-1"
-          CLOUDFRONT_KEY_PAIR_ID: "K3814DK2QUJ71H"
+          CLOUDFRONT_KEY_PAIR_ID: "K1MTLUUQ6YN2UZ"
           CLOUDFRONT_PRIVATE_KEY: ${{ secrets.CLOUDFRONT_PRIVATE_KEY }}
         run: docker compose up -d --wait --wait-timeout 20
       - name: Install poetry

.github/workflows/_unit-tests-python.yml

@@ -58,6 +58,6 @@ jobs:
           CACHED_ASSETS_STORAGE_ROOT: /tmp/cached-assets
           S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
           S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
-          CLOUDFRONT_KEY_PAIR_ID: "K3814DK2QUJ71H"
+          CLOUDFRONT_KEY_PAIR_ID: "K1MTLUUQ6YN2UZ"
           CLOUDFRONT_PRIVATE_KEY: ${{ secrets.CLOUDFRONT_PRIVATE_KEY }}
         run: poetry run python -m pytest -s -m "not real_dataset and not integration"

libs/libcommon/tests/test_integration_s3_cloudfront.py

@@ -15,7 +15,7 @@
 from .constants import CI_HUB_ENDPOINT
 
 BUCKET = "hf-datasets-server-statics-test"
-CLOUDFRONT_KEY_PAIR_ID = "K3814DK2QUJ71H"
+CLOUDFRONT_KEY_PAIR_ID = "K1MTLUUQ6YN2UZ"
 
 
 def test_real_cloudfront(monkeypatch: pytest.MonkeyPatch) -> None: