Integration
GitHub integration
Check model dependencies automatically when your application changes.
PinDiff scans each pull request for Hugging Face model references, records the configured revision, classifies it as pinned, floating or unknown, and adds relevant upstream changes with links to the evidence.
How it works
-
Create a token
Sign in and create a token scoped to checks. PinDiff stores only a hash, and the token can be revoked at any time.
-
Add the workflow
The action asks for
contents: read, scans the checkout locally without running model code, and sends dependency metadata only. -
Review the pull request
The job summary lists each dependency with its revision state and any upstream change that may affect it.
Example pull request result
Example output. The check is informational: the build is not failed because a dependency is floating, a revision is unknown or a model changed upstream.
## PinDiff Model Dependency Check 3 dependencies detected 🔴 biohub/ESMC-6B floating: main upstream: Remote code configuration changed ⚠ BAAI/bge-large floating: main ✓ Qwen/Qwen3 pinned: 82fa41f ### Changes in this pull request Recorded revision changed BAAI/bge-large pinned 4e1a2d9 → floating main ### Upstream intelligence biohub/ESMC-6B Remote code configuration changed Your dependency follows main. A future download may retrieve the newer upstream revision. View change evidence This check is informational. PinDiff does not fail the build because a dependency is floating, because a revision is unknown, or because a model changed upstream.
Read the full setup guide to see every step, the files added to your repository and what each part of the result means.
Example workflow
This is .github/workflows/pindiff.yml. It runs the action in .github/actions/audit, which comes in the PinDiff bundle together with the scanner it uses. The action scans the checkout locally and sends dependency metadata only. It asks for contents: read. Results are written to the Actions job summary. The build is not failed because a dependency is floating or because a model changed upstream.
name: PinDiff model dependencies
on:
pull_request:
permissions:
contents: read
jobs:
pindiff:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: ./.github/actions/audit
with:
token: ${{ secrets.PINDIFF_TOKEN }}
api-url: https://pindiff.com
What PinDiff checks
- model references
- configured revisions
- pinned, floating and unknown state
- relevant upstream changes
What PinDiff does not do
- execute model code
- decide whether a model is safe
- approve or reject AI usage
Connect GitHub
PinDiff does not install a GitHub App and does not ask for repository administration. Connection uses a scoped token and the PinDiff GitHub Action.