chore(deps): bump huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from bcff59fca682130d2e7271ca8589911b7ac0b8bf to 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7

[dependabot]

Bumps huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from bcff59fca682130d2e7271ca8589911b7ac0b8bf to 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7.

Commits

• 7e6bd45 Add tomli to openenv real doc-build deps (#803)
• e60a538 Add --mock_deps: build docs without installing heavy dependencies (#801)
• a601280 feat: page-level HTML build cache backed by HF storage buckets (#800)
• 41c17d1 refactor: modernize build and preview commands (#798)
• 2f7376e Simplify docstring pipeline: python emits the <Docstring> component directly ...
• 7241b19 refactor(kit): migrate components to Svelte 5 runes syntax (#795)
• 707e116 fix(kit): keep shorthand doc URLs in the address bar on client-side nav (#794)
• e2e7253 fix(kit): repair <table><tr> nesting for Svelte 5 compatibility (#793)
• c669bea Upgrade kit/ to Svelte 5, SvelteKit 2, Vite 7, Tailwind 4, ESLint 10 (#792)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Single CI workflow SHA bump with no application or secret changes; other doc-builder workflows in this repo remain on the old pin.

Overview
Updates the Upload PR Documentation reusable workflow pin from huggingface/doc-builder commit bcff59f to 7e6bd45.

That upstream revision includes doc-build improvements (e.g. tomli in real doc-build deps, --mock_deps, HTML build cache, Svelte 5 / kit upgrades). Only the post-build upload job that runs after Build PR Documentation completes is affected; package_name: openenv and HF/comment-bot secrets are unchanged.

^{Reviewed by Cursor Bugbot for commit 1eb9de6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Dependabot bumps the pinned commit SHA of the shared huggingface/doc-builder upload_pr_documentation.yml reusable workflow (bcff59f → 7e6bd45). Single-line CI / docs-build infrastructure change — no Python, environment, or API code is touched.

Automated Checks

• Lint (.claude/hooks/lint.sh): PASS for this PR's scope. The hook exits non-zero, but only because of ~20 pre-existing unformatted files under envs/ (agent_world_model_env, chat_env, coding_tools_env, jupyter_env, opencode_env, repl_env, terminus_env, textarena_env). None are touched here — this PR changes zero .py files (git diff --name-only = only the workflow YAML), and the working tree is clean after the hook reverts its formatting.
• Debug code (.claude/hooks/check-debug.sh): CLEAN for this PR's scope. The hook lists pre-existing print/TODO occurrences across src/, but none are in the changed file (the hook scans only src/; this PR touches no Python).

Change verification

• ✅ New SHA is legitimate — 7e6bd45 is the current HEAD of doc-builder's main (compare status: identical), so the trailing # main comment stays accurate. Clean fast-forward: 9 commits ahead, 0 behind.
• ✅ Caller contract unchanged — the consumed workflow's workflow_call inputs/secrets are identical across the two SHAs; only internal step implementation changed (pip → uv/uvx, added SHA-pinned astral-sh/setup-uv). OpenEnv's call site (package_name: openenv + hf_token / comment_bot_app_id / comment_bot_secret_pem) remains valid — it won't fail to start.
• ✅ Security best practice maintained — still pinned to a full 40-char commit SHA (not a tag or moving branch ref).
• ✅ Relevant intent — the tip commit is doc-builder #803 "Add tomli to openenv real doc-build deps", a change made specifically for OpenEnv's own doc build.
• ✅ Artifact contract stable — upload_pr_documentation.yml consumes the doc-build-artifact produced by build_pr_documentation.yml. The artifact name (doc-build-artifact) and build_dir/ layout (incl. commit_sha) are unchanged between the old build workflow and the new upload workflow, so moving only the upload half forward carries no functional skew risk.

Open RFCs Context

Open RFCs: 000-project-phases, 001-abstractions, 002-env-spec, 003-mcp-support, 005-agentic-harnesses (all In Review); 010-echo-env-token-world-model (Draft); 004-rubrics (no status header). None are relevant — every RFC concerns core environment/agent design (abstractions, env spec, MCP, harnesses, rubrics/rewards, token world-modeling), not CI or the documentation-build pipeline.

Tier 1: Fixes Required

None. No mechanical issues are introduced by this PR.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. This is CI/docs infrastructure and does not touch any principle/invariant surface (Gymnasium reset/step/state signatures, rewards-in-environment, client-server separation, MCP/WebSocket dual boundary, or Pydantic wire types).

RFC Conflicts

None identified. No open RFC covers CI, dependency management, or the documentation-build pipeline.

Additional observations (non-blocking / informational)

• Two sibling pins to the same doc-builder repo remain on the old SHA bcff59f: build_pr_documentation.yml:13 and build_documentation.yml:12. Dependabot's github-actions updater treats each distinct uses: path as a separate dependency, so it should raise sibling PRs for those. This PR is safe to merge on its own (artifact contract verified above), but it's worth keeping the doc build and upload pins roughly in sync as they land. FYI @burtenshaw (owner of .github/dependabot.yml / CI config).

Summary

• 0 mechanical issues to fix (Tier 1)
• 0 alignment points for human review (Tier 2 principles)
• 0 RFC conflicts to discuss

Clean, in-scope, first-party dependency bump — no blocking issues.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Verified this bump: 7e6bd45 is the current HEAD of doc-builder@main (clean fast-forward — 9 ahead / 0 behind), still pinned to a full commit SHA. The reusable workflow's workflow_call inputs/secrets are unchanged between bcff59f and 7e6bd45 (only internal pip → uv/uvx step changes), so this call site's package_name + hf_token/comment_bot_app_id/comment_bot_secret_pem remain valid — no breaking change to the caller contract.

[burtenshaw]

Superseded by aggregate Dependabot PR #930. Closing this single Dependabot PR so maintainers have one non-env dependency rollup to review.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.