Book a demo Start for free

For engineering teams

Know which external models your code loads, and which revision.

Find every Hugging Face model your code loads, see which revision it uses, and know whether an upstream change can reach you.

  • Never runs your code
  • Pinned, floating or unknown
  • Informational GitHub check
Create a free account How PinDiff works
Terminal
$ pindiff audit .
Scanning project for Hugging Face model dependencies...

Found 3 Hugging Face dependencies in 42 Python files:
✓ 1 pinned to a specific revision
⚠ 1 using floating revisions
? 1 with unknown revision or repository

STATUS       REPOSITORY                REVISION
✓ PINNED     example-org/chat-7b       3f9a2c1
⚠ FLOATING   example-org/embed-large   main (default)
? UNKNOWN    MODEL_NAME (dynamic)      (unknown)
Example

How it works for your team

  1. 1

    Find model dependencies in code

    Run pindiff audit in a repository. It reads Python files without running them.

    • Detects from_pretrained(), snapshot_download() and hf_hub_download()
    • Picks up Hugging Face model URLs
    • Runtime values like MODEL_NAME are reported as unknown, never guessed
    Audit a project
    app/models.py
    1from transformers import AutoModel
    2from huggingface_hub import snapshot_download
    3
    4chat = AutoModel.from_pretrained("example-org/chat-7b", revision="3f9a2c1")Pinned
    5embed = snapshot_download("example-org/embed-large")Floating
    6clf = AutoModel.from_pretrained(MODEL_NAME)Unknown

    Read only. Nothing in this file is executed.

    Example
  2. 2

    Record the revision you use

    Every dependency gets one of three revision states.

    • Pinned: an exact commit that cannot move
    • Floating: main, a branch or a tag that can move later
    • Unknown: no revision, or one set at runtime
    How revisions are tracked
    Pinned revision="3f9a2c1"

    An exact commit. It always points to the same files.

    Floating main · v1.2 · no revision

    Can resolve to a newer commit on the next download.

    ? Unknown revision=REV

    Set at runtime. Record the revision to see your exposure.

    Example
  3. 3

    See your exposure, not a risk score

    The same upstream change means different things for different revisions.

    • Upstream significance and your exposure are shown separately
    • Pinned to an earlier commit: no automatic effect
    • Following main: potentially affected on the next download
    How exposure is decided
    Upstream change Weights changed in example-org/chat-7b Critical significance
    api/ uses Pinned 3f9a2c1 No automatic effect

    Your recorded revision remains pinned to 3f9a2c1.

    Review before upgrading.
    worker/ uses Floating main Potentially affected

    A future download may retrieve the newer upstream revision.

    Review the change, or pin an exact revision.
    Example
  4. 4

    Review exactly what changed

    Changes are summarised by category, with stored before-and-after evidence.

    • Weights by file name, hash and size
    • Licence, remote code, access and model card
    • Each change links to its evidence page
    Browse the change feed
    example-org/chat-7b 3f9a2c1 → 8b7d4e0
    • Weights 2 files changed
    • Model card Modified
    • Licence Unchanged
    • Remote code Unchanged
    • Access Unchanged
    model-00001-of-00002.safetensors a41c…9e02 → 7d3b…11fa 4.97 GB
    model-00002-of-00002.safetensors c88e…04b1 → 2f6a…d93c 3.12 GB
    Example
  5. 5

    Report it in GitHub Actions

    The PinDiff Action writes a dependency check to the job summary on each pull request.

    • Scans the checkout locally and needs only contents: read
    • Sends dependency metadata, not source code
    • Never fails a build because a dependency is floating or changed
    GitHub integration
    Actions · Job summary

    PinDiff Model Dependency Check

    3 dependencies detected

    ✓
    example-org/chat-7bpinned: 3f9a2c1
    ⚠
    example-org/embed-largefloating: mainupstream: model weights changed
    ?
    MODEL_NAME (dynamic)unknown: revision not determined
    Example

Not available yet

Inviting teammates to a workspace is not available yet.

Start with the models your services already load.

The Free plan covers up to 10 models, each with its recorded revision. Paid plans raise the limit.

Create a free account See pricing

Already have an account? Sign in