TruffleHog's Lob API-key detector matches `\b((live|test)_[a-zA-Z0-9_]{35})\b`.
One EMA config test was named `test_` plus exactly 35 word characters, so it
matched, and Lob's verifier treats the 403/422 that api.lob.com returns for junk
keys as proof of a live key. That failed the Security workflow on main after
huggingface/lerobot#4323 with "Found verified Lob result" and exit code 183.
Add one word to the name so the suffix is 39 characters rather than 35. No
behavior change. Note that the offending string is deliberately not spelled out
here: TruffleHog scans commit messages as well as added lines, so quoting it
would retrigger the very detector this commit is working around.
Refs #4323
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* feat(train): add opt-in EMA of the policy weights (--ema.enable=true)
Maintain an EMA shadow via diffusers' EMAModel (lazy import, no new
dependency) with the reference Diffusion Policy schedule. Saves the
shadow for exact resume plus a loadable pretrained_model_ema/ per
checkpoint, evaluates the EMA weights during env eval, and pushes them
to a sibling <repo_id>-ema repo. Fixeshuggingface/lerobot#4259.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(diffusion): document the --ema.enable training flag
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(tests): skip EMA training tests when accelerate/diffusers are missing
* feat(train): support constant EMA decay (--ema.decay) for openpi-style policies
* fix(train): gate EMA step on sync_gradients; use parallel_dims.is_sharded guard
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Pepijn