feat: add trusted orgs and flag

[drbh]

This PR adds a trust_remote_code and hardcoded list of trusted orgs

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[sayakpaul]

Suggested change

	TRUSTED_KERNEL_ORGS = {"kernels-community", "kernels-test", "sglang"}
	TRUSTED_KERNEL_ORGS = {"kernels-community", "kernels-staging", "kernels-test", "sglang"}

[julien-c]

please rely on the hub api for this, so it's consistent with the UI:

[julien-c]

(cc @krampstudio)

[sayakpaul]

{"kernels-community", "kernels-staging", "kernels-test", "sglang"}

Can we ensure the above list is consistent with the Hub?

[drbh]

thanks for the feedback, i've updated _check_trust_remote_code to check the repo_info response for the trustedPublisher attribute.

full logic is:

1. if trust_remote_code=True, skip all checks
2. check the hardcoded list (just "kernels-test" for now)
3. fetch the repo_info and check attribute

[krampstudio]

{"kernels-community", "kernels-staging", "kernels-test", "sglang"}

Can we ensure the above list is consistent with the Hub?

Here is the list configured on the Hub:

[danieldk]

Do we need this, since kernels-test is already a trusted org. That way, this would get properly tested during tests as well.

[drbh]

nope this is unneeded now (just ran into some CI issues without this special case earlier). it looks like kernels-test are returning the trustedPublisher attribute now after some spot checks.

removed in latest

[drbh]

ahh the issue is now we surface a untrusted publisher if the repo info cannot be fetched since the check depends on the repo info. need to revisit with a better solution