Add opt-in public certificate links

Publish certificates only when users opt in, expose a permanent Hub URL, and pass it to LinkedIn as certUrl.\n\nRequires an HF_TOKEN Space secret with write access to ICML-2026-agent-repro/certificates.

.pytest_cache/.gitignore

@@ -0,0 +1,2 @@
+# Created by pytest automatically.
+*

.pytest_cache/CACHEDIR.TAG

@@ -0,0 +1,4 @@
+Signature: 8a477f597d28d172789f06886806bc55
+# This file is a cache directory tag created by pytest.
+# For information about cache directory tags, see:
+#	https://bford.info/cachedir/spec.html

.pytest_cache/README.md

@@ -0,0 +1,8 @@
+# pytest cache directory #
+
+This directory contains data from the pytest's cache plugin,
+which provides the `--lf` and `--ff` options, as well as the `cache` fixture.
+
+**Do not** commit this to version control.
+
+See [the docs](https://docs.pytest.org/en/stable/how-to/cache.html) for more information.

.pytest_cache/v/cache/lastfailed

@@ -0,0 +1 @@
+{}

.pytest_cache/v/cache/nodeids

@@ -0,0 +1,9 @@
+[
+  "test_app.py::test_auth_control_uses_sandbox_safe_navigation",
+  "test_app.py::test_certificate_is_not_published_without_opt_in",
+  "test_app.py::test_certificate_is_published_after_opt_in",
+  "test_app.py::test_linkedin_url_includes_public_certificate_url",
+  "test_app.py::test_oauth_login_clears_stale_session_before_redirecting",
+  "test_app.py::test_publish_certificate_uses_stable_public_path",
+  "test_app.py::test_root_frontend_asset_is_served"
+]

README.md

@@ -18,3 +18,8 @@ Eligibility: at least one claim judged **verified** by the automated Logbook
 Judge before the challenge deadline (frozen in `eligible.json` at challenge
 close; 267 participants qualify). Certificates render in-Space with headless
 Chromium and include your verified-claim statistics and partner logos.
+
+Participants can optionally publish their generated certificate to the public
+`ICML-2026-agent-repro/certificates` dataset. The resulting permanent URL is
+shown in the app and used as LinkedIn's credential URL. The Space needs an
+`HF_TOKEN` secret with write access to that dataset.

app.py

@@ -20,8 +20,13 @@ import gradio as gr
 import uvicorn
 from fastapi import FastAPI
 from fastapi.responses import RedirectResponse
+from huggingface_hub import upload_file
 
 DISCUSSIONS_URL = "https://huggingface.co/spaces/ICML-2026-agent-repro/challenge/discussions"
+SPACE_URL = "https://huggingface.co/spaces/ICML-2026-agent-repro/certificate-generator"
+CERTIFICATES_DATASET = os.getenv(
+    "CERTIFICATES_DATASET", "ICML-2026-agent-repro/certificates"
+)
 CANVAS = (2000, 1414)  # must match the body size in certificate_template.html
 
 _HERE = os.path.dirname(__file__)
@@ -110,18 +115,35 @@ def on_load(profile: gr.OAuthProfile | None):
             profile.name or profile.username)
 
 
-def linkedin_url(name):
+def publish_certificate(username, image_path):
+    path_in_repo = f"certificates/{username.lower()}.png"
+    upload_file(
+        path_or_fileobj=image_path,
+        path_in_repo=path_in_repo,
+        repo_id=CERTIFICATES_DATASET,
+        repo_type="dataset",
+        token=os.getenv("HF_TOKEN"),
+    )
+    encoded_path = urllib.parse.quote(path_in_repo, safe="/")
+    return (
+        f"https://huggingface.co/datasets/{CERTIFICATES_DATASET}/"
+        f"resolve/main/{encoded_path}"
+    )
+
+
+def linkedin_url(cert_url, username):
     p = {
         "startTask": "CERTIFICATION_NAME",
         "name": "ICML 2026 Open Reproductions — Certificate of Participation",
         "organizationName": "Hugging Face",
         "issueYear": "2026", "issueMonth": "8",
-        "certUrl": "https://huggingface.co/spaces/ICML-2026-agent-repro/certificate-generator",
+        "certUrl": cert_url,
+        "certId": username,
     }
     return "https://www.linkedin.com/profile/add?" + urllib.parse.urlencode(p)
 
 
-def create_certificate(display_name, profile: gr.OAuthProfile | None):
+def create_certificate(display_name, make_public, profile: gr.OAuthProfile | None):
     if profile is None:
         return None, "❌ Please sign in first.", gr.update(visible=False)
     rec = ELIGIBLE.get(profile.username.lower())
@@ -133,10 +155,26 @@ def create_certificate(display_name, profile: gr.OAuthProfile | None):
         image_path = render_html(html)
     except Exception as e:
         return None, f"❌ Rendering failed: {e}. Please try again in a minute.", gr.update(visible=False)
-    btn = (f'<a href="{linkedin_url(name)}" target="_blank" '
+
+    cert_url = SPACE_URL
+    if make_public:
+        try:
+            cert_url = publish_certificate(profile.username, image_path)
+        except Exception as e:
+            print(f"Certificate upload failed for @{profile.username}: {e}")
+            note = ("⚠️ Your certificate is ready to download, but its public URL could not "
+                    "be created. Please try generating it again in a minute.")
+        else:
+            note = ("🎉 Your certificate is ready. Anyone with your "
+                    f"[public certificate URL]({cert_url}) can view it.")
+    else:
+        note = ("🎉 Your certificate is ready to download. It was not published; enable "
+                "the public sharing option and generate it again to create a permanent URL.")
+
+    btn = (f'<a href="{linkedin_url(cert_url, profile.username)}" target="_blank" '
            f'style="display:inline-block;background:#0a66c2;color:#fff;font-weight:700;'
            f'padding:10px 22px;border-radius:8px;text-decoration:none">Add to LinkedIn profile →</a>')
-    return image_path, "🎉 Your certificate is ready — download it or add it to your LinkedIn profile below.", gr.update(value=btn, visible=True)
+    return image_path, note, gr.update(value=btn, visible=True)
 
 
 THEME = gr.themes.Base(
@@ -175,13 +213,24 @@ with gr.Blocks(title="ICML 2026 Open Reproductions — Certificates", theme=THEM
     status = gr.Markdown()
     with gr.Column(visible=False) as main_box:
         name_box = gr.Textbox(label="Name on the certificate")
+        public_share = gr.Checkbox(
+            value=False,
+            label="Create a public shareable certificate URL",
+            info=("Publishes your certificate image and displayed name in a public Hugging "
+                  "Face dataset. Your username appears in the URL; generating again replaces "
+                  "the image at that URL."),
+        )
         gen_btn = gr.Button("Generate my certificate 🎓", variant="primary")
         cert_image = gr.Image(label="Your certificate", type="filepath", interactive=False)
         note = gr.Markdown()
         linkedin = gr.HTML(visible=False)
 
     demo.load(on_load, inputs=None, outputs=[auth, main_box, status, name_box])
-    gen_btn.click(create_certificate, inputs=[name_box], outputs=[cert_image, note, linkedin])
+    gen_btn.click(
+        create_certificate,
+        inputs=[name_box, public_share],
+        outputs=[cert_image, note, linkedin],
+    )
 
 
 app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)

test_app.py

@@ -2,6 +2,7 @@ import importlib
 import os
 import re
 from types import SimpleNamespace
+from urllib.parse import parse_qs, quote, urlparse
 
 from fastapi.testclient import TestClient
 
@@ -59,3 +60,75 @@ def test_root_frontend_asset_is_served():
         asset_response = client.get(asset_path)
 
     assert asset_response.status_code == 200
+
+
+def eligible_profile():
+    username = next(iter(certificate_app.ELIGIBLE))
+    return SimpleNamespace(username=username, name="Test Participant")
+
+
+def test_linkedin_url_includes_public_certificate_url():
+    url = certificate_app.linkedin_url(
+        "https://huggingface.co/datasets/example/certificates/resolve/main/test.png",
+        "test-user",
+    )
+    params = parse_qs(urlparse(url).query)
+
+    assert params["certUrl"] == [
+        "https://huggingface.co/datasets/example/certificates/resolve/main/test.png"
+    ]
+    assert params["certId"] == ["test-user"]
+
+
+def test_publish_certificate_uses_stable_public_path(monkeypatch):
+    upload = {}
+    monkeypatch.setenv("HF_TOKEN", "test-token")
+    monkeypatch.setattr(
+        certificate_app,
+        "upload_file",
+        lambda **kwargs: upload.update(kwargs),
+    )
+
+    url = certificate_app.publish_certificate("Test-User", "/tmp/certificate.png")
+
+    assert upload == {
+        "path_or_fileobj": "/tmp/certificate.png",
+        "path_in_repo": "certificates/test-user.png",
+        "repo_id": certificate_app.CERTIFICATES_DATASET,
+        "repo_type": "dataset",
+        "token": "test-token",
+    }
+    assert url.endswith("/resolve/main/certificates/test-user.png")
+
+
+def test_certificate_is_not_published_without_opt_in(monkeypatch):
+    profile = eligible_profile()
+    monkeypatch.setattr(certificate_app, "render_html", lambda html: "/tmp/certificate.png")
+
+    def unexpected_upload(username, image_path):
+        raise AssertionError("certificate should not be published")
+
+    monkeypatch.setattr(certificate_app, "publish_certificate", unexpected_upload)
+
+    image_path, note, linkedin = certificate_app.create_certificate("Test", False, profile)
+
+    assert image_path == "/tmp/certificate.png"
+    assert "was not published" in note
+    assert quote(certificate_app.SPACE_URL, safe="") in linkedin["value"]
+
+
+def test_certificate_is_published_after_opt_in(monkeypatch):
+    profile = eligible_profile()
+    public_url = "https://huggingface.co/datasets/example/certificates/resolve/main/test.png"
+    monkeypatch.setattr(certificate_app, "render_html", lambda html: "/tmp/certificate.png")
+    monkeypatch.setattr(
+        certificate_app,
+        "publish_certificate",
+        lambda username, image_path: public_url,
+    )
+
+    image_path, note, linkedin = certificate_app.create_certificate("Test", True, profile)
+
+    assert image_path == "/tmp/certificate.png"
+    assert public_url in note
+    assert quote(public_url, safe="") in linkedin["value"]