[hf-security-analysis]

Automated hardening of the workflow files flagged on #49057.

Targets main. Files changed, and what changed them:

• .github/workflows/check_failed_tests.yml — action pins

Fixed by this PR:

• HIGH unpinned-action (pinact) — .github/workflows/check_failed_tests.yml:397

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.

Closes huggingface/tracking-issues#1020

[github-actions]

Thank you for your contribution 🤗!

CI Security Gate — automatic approval blocked

This PR was not automatically approved for CI because the security gate failed.

Possible reasons:

• The PR touches 50 or more files — only PRs with fewer than 50 changed files are automatically approved
• A changed file is outside the allowed directories (src/, tests/, docs/, utils/), has a disallowed extension (only .py, .txt, .md permitted outside tests/ and docs/), or is not .md/.yml inside docs/ — this covers files the PR deletes or renames, not only the ones it edits
• A new high-severity security issue was detected in the changed Python files (Bandit check)
• The PR touches a path this repository protects from untrusted PRs, such as the file that decides who reviews it — a maintainer must make that change in a separate PR

See the workflow run for the exact violations.

A maintainer can review and manually approve CI if a finding is a false positive.

[github-actions]

---

CI recap

Dashboard: View test results in Grafana
Latest run: 35880411271
Result: success | Grafana metrics are not available yet.

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.