chore(deps): bump huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from bcff59fca682130d2e7271ca8589911b7ac0b8bf to 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7 - #927
Conversation
…_documentation.yml Bumps [huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml](https://github.com/huggingface/doc-builder) from bcff59fca682130d2e7271ca8589911b7ac0b8bf to 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7. - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Commits](huggingface/doc-builder@bcff59f...7e6bd45) --- updated-dependencies: - dependency-name: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml dependency-version: 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
github_actions
burtenshaw
added
enhancement
Cursor
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Dependabot bumps the pinned commit SHA of the shared huggingface/doc-builder upload_pr_documentation.yml reusable workflow (bcff59f → 7e6bd45). Single-line CI / docs-build infrastructure change — no Python, environment, or API code is touched.
Automated Checks
- Lint (
.claude/hooks/lint.sh): PASS for this PR's scope. The hook exits non-zero, but only because of ~20 pre-existing unformatted files underenvs/(agent_world_model_env, chat_env, coding_tools_env, jupyter_env, opencode_env, repl_env, terminus_env, textarena_env). None are touched here — this PR changes zero.pyfiles (git diff --name-only= only the workflow YAML), and the working tree is clean after the hook reverts its formatting. - Debug code (
.claude/hooks/check-debug.sh): CLEAN for this PR's scope. The hook lists pre-existingprint/TODOoccurrences acrosssrc/, but none are in the changed file (the hook scans onlysrc/; this PR touches no Python).
Change verification
- ✅ New SHA is legitimate —
7e6bd45is the currentHEADofdoc-builder'smain(comparestatus: identical), so the trailing# maincomment stays accurate. Clean fast-forward: 9 commits ahead, 0 behind. - ✅ Caller contract unchanged — the consumed workflow's
workflow_callinputs/secrets are identical across the two SHAs; only internal step implementation changed (pip→uv/uvx, added SHA-pinnedastral-sh/setup-uv). OpenEnv's call site (package_name: openenv+hf_token/comment_bot_app_id/comment_bot_secret_pem) remains valid — it won't fail to start. - ✅ Security best practice maintained — still pinned to a full 40-char commit SHA (not a tag or moving branch ref).
- ✅ Relevant intent — the tip commit is doc-builder #803 "Add tomli to openenv real doc-build deps", a change made specifically for OpenEnv's own doc build.
- ✅ Artifact contract stable —
upload_pr_documentation.ymlconsumes thedoc-build-artifactproduced bybuild_pr_documentation.yml. The artifact name (doc-build-artifact) andbuild_dir/layout (incl.commit_sha) are unchanged between the old build workflow and the new upload workflow, so moving only the upload half forward carries no functional skew risk.
Open RFCs Context
Open RFCs: 000-project-phases, 001-abstractions, 002-env-spec, 003-mcp-support, 005-agentic-harnesses (all In Review); 010-echo-env-token-world-model (Draft); 004-rubrics (no status header). None are relevant — every RFC concerns core environment/agent design (abstractions, env spec, MCP, harnesses, rubrics/rewards, token world-modeling), not CI or the documentation-build pipeline.
Tier 1: Fixes Required
None. No mechanical issues are introduced by this PR.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. This is CI/docs infrastructure and does not touch any principle/invariant surface (Gymnasium reset/step/state signatures, rewards-in-environment, client-server separation, MCP/WebSocket dual boundary, or Pydantic wire types).
RFC Conflicts
None identified. No open RFC covers CI, dependency management, or the documentation-build pipeline.
Additional observations (non-blocking / informational)
- Two sibling pins to the same
doc-builderrepo remain on the old SHAbcff59f:build_pr_documentation.yml:13andbuild_documentation.yml:12. Dependabot'sgithub-actionsupdater treats each distinctuses:path as a separate dependency, so it should raise sibling PRs for those. This PR is safe to merge on its own (artifact contract verified above), but it's worth keeping the doc build and upload pins roughly in sync as they land. FYI @burtenshaw (owner of.github/dependabot.yml/ CI config).
Summary
- 0 mechanical issues to fix (Tier 1)
- 0 alignment points for human review (Tier 2 principles)
- 0 RFC conflicts to discuss
Clean, in-scope, first-party dependency bump — no blocking issues.
Sent by Cursor Automation: Pre-review
| jobs: | ||
| build: | ||
| uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@bcff59fca682130d2e7271ca8589911b7ac0b8bf # main | ||
| uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@7e6bd45ee271b96e75484eeafea1b3e6139cd0c7 # main |
There was a problem hiding this comment.
Verified this bump: 7e6bd45 is the current HEAD of doc-builder@main (clean fast-forward — 9 ahead / 0 behind), still pinned to a full commit SHA. The reusable workflow's workflow_call inputs/secrets are unchanged between bcff59f and 7e6bd45 (only internal pip → uv/uvx step changes), so this call site's package_name + hf_token/comment_bot_app_id/comment_bot_secret_pem remain valid — no breaking change to the caller contract.
|
Superseded by aggregate Dependabot PR #930. Closing this single Dependabot PR so maintainers have one non-env dependency rollup to review. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from bcff59fca682130d2e7271ca8589911b7ac0b8bf to 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7.
Commits
7e6bd45Add tomli to openenv real doc-build deps (#803)e60a538Add --mock_deps: build docs without installing heavy dependencies (#801)a601280feat: page-level HTML build cache backed by HF storage buckets (#800)41c17d1refactor: modernize build and preview commands (#798)2f7376eSimplify docstring pipeline: python emits the <Docstring> component directly ...7241b19refactor(kit): migrate components to Svelte 5 runes syntax (#795)707e116fix(kit): keep shorthand doc URLs in the address bar on client-side nav (#794)e2e7253fix(kit): repair <table><tr> nesting for Svelte 5 compatibility (#793)c669beaUpgrade kit/ to Svelte 5, SvelteKit 2, Vite 7, Tailwind 4, ESLint 10 (#792)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Single CI workflow SHA bump with no application or secret changes; other doc-builder workflows in this repo remain on the old pin.
Overview
Updates the Upload PR Documentation reusable workflow pin from
huggingface/doc-buildercommitbcff59fto7e6bd45.That upstream revision includes doc-build improvements (e.g.
tomliin real doc-build deps,--mock_deps, HTML build cache, Svelte 5 / kit upgrades). Only the post-build upload job that runs after Build PR Documentation completes is affected;package_name: openenvand HF/comment-bot secrets are unchanged.Reviewed by Cursor Bugbot for commit 1eb9de6. Bugbot is set up for automated code reviews on this repo. Configure here.