chore(deps): aggregate core dependabot updates - #930
Conversation
burtenshaw
added
codex
codex-automation
Dependencies
github_actions
burtenshaw
added
enhancement
Cursor
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
…_documentation.yml Bumps [huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml](https://github.com/huggingface/doc-builder) from bcff59fca682130d2e7271ca8589911b7ac0b8bf to 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7. - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Commits](huggingface/doc-builder@bcff59f...7e6bd45) --- updated-dependencies: - dependency-name: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml dependency-version: 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…documentation.yml Bumps [huggingface/doc-builder/.github/workflows/build_pr_documentation.yml](https://github.com/huggingface/doc-builder) from bcff59fca682130d2e7271ca8589911b7ac0b8bf to 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7. - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Commits](huggingface/doc-builder@bcff59f...7e6bd45) --- updated-dependencies: - dependency-name: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml dependency-version: 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…n_documentation.yml Bumps [huggingface/doc-builder/.github/workflows/build_main_documentation.yml](https://github.com/huggingface/doc-builder) from bcff59fca682130d2e7271ca8589911b7ac0b8bf to 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7. - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Commits](huggingface/doc-builder@bcff59f...7e6bd45) --- updated-dependencies: - dependency-name: huggingface/doc-builder/.github/workflows/build_main_documentation.yml dependency-version: 7e6bd45ee271b96e75484eeafea1b3e6139cd0c7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
a6dd94d to
281405f
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
This PR aggregates the three huggingface/doc-builder reusable-workflow SHA bumps (previously split as #927/#928/#929), moving all three doc workflows from bcff59f → 7e6bd45. The bump itself is correct and beneficial, but the branch is now stale vs main and will not merge cleanly — see Tier 1.
Automated Checks
- Lint: PASS (for this PR's scope).
lint.shexits non‑zero, but every flagged path is a pre‑existingenvs/reformat candidate (opencode_env,chat_env,coding_tools_env, …). This PR changes 0.pyfiles and YAML isn't linted, so it introduces no new lint issues. - Debug code: CLEAN (for this PR's scope).
check-debug.shonly lists pre‑existingsrc/prints/TODOs; zero are in changed files (no.pytouched).
Open RFCs Context
RFCs 000–003 & 005 are In Review, 010 is Draft, 004 has no status header. All cover the runtime env/agent design (project phases, abstractions, env‑spec, MCP, rubrics/rewards, agentic harnesses, token world‑model). None cover CI, GitHub Actions, the docs‑build pipeline, or dependency management — so none are relevant here.
Tier 1: Fixes Required
- Stale branch — 3‑way merge conflict with
main(needs a rebase; not auto‑fixable from a review run). ~39s after this PR opened (07:02:31Z), #923 ("Make doc builds faster", merged07:03:10Z) advancedbuild_documentation.ymlandbuild_pr_documentation.ymltoe60a538— which is the direct parent of this PR's7e6bd45. Because both sides edit the sameuses:pin line from the oldbcff59f,git merge-tree origin/main <head>reportsCONFLICT (content)in both files.upload_pr_documentation.ymlstill merges cleanly (mainleft it atbcff59f).- Note: GitHub's mergeability currently shows
MERGEABLE/CLEAN, but that is a stale cache from the 39‑second window before #923 landed; it will flip to conflicting once GitHub recomputes. - Resolution: rebase
codex/dependabot-core-2026-07-07onto currentmainand keep7e6bd45on all threeuses:lines. That's a clean +1‑commit forward move for the two build workflows and +9 for upload, and it also fixes the skew #923 left onmain(build/build_pr @e60a538, upload @bcff59f) by unifying all three at the doc‑buildermaintip. (Owner of.github/+ dependabot config: @burtenshaw.)
- Note: GitHub's mergeability currently shows
Tier 2: Alignment Discussion
Principle Conflicts
None identified. The changed surface is CI‑only. Full‑SHA pinning + dependabot freshness aligns with the "container isolation for reproducibility and security" principle (.claude/docs/PRINCIPLES.md:15).
RFC Conflicts
None identified.
Verification (positive signals)
- New SHA legitimate:
7e6bd45is a real doc‑builder commit (mishig25, doc‑builder #803), isidenticalto doc‑builder'smaintip, sits 9 ahead / 0 behindbcff59f, and is still a full 40‑char SHA (no tag/branch downgrade). - Caller contract unchanged: the only delta over
e60a538(whichmainalready runs on the build workflows) ismock_deps/openenv.txt— it addstomlifor OpenEnv's own light doc build. No reusable‑workflow input/secret change, so the bump is interface‑safe and directly benefits OpenEnv's docs. Secrets still passed viasecrets.*(no credential exposure).
Summary
- 1 mechanical issue — stale branch → rebase to resolve the merge conflict with #923 (underlying bump is correct).
- 0 alignment points for human review.
- 0 RFC conflicts.
Sent by Cursor Automation: Pre-review
| jobs: | ||
| build: | ||
| uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@e60a538eea9817ab312196d0d233604b01697265 # main | ||
| uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@7e6bd45ee271b96e75484eeafea1b3e6139cd0c7 # main |
There was a problem hiding this comment.
Merge conflict with main. #923 ("Make doc builds faster", merged ~39s after this PR opened) already advanced this pin to e60a538, the direct parent of 7e6bd45. Since this PR re-pins the same line from the old bcff59f, a 3-way merge conflicts here — git merge-tree origin/main <head> confirms CONFLICT (content). (GitHub's current mergeable flag is a stale cache from before #923 landed.)
Rebase onto current main and keep 7e6bd45 — it's a clean +1-commit forward move (doc-builder #803, which adds tomli for OpenEnv's own doc build).
| build: | ||
| if: github.event.pull_request.draft == false | ||
| uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@e60a538eea9817ab312196d0d233604b01697265 # main | ||
| uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@7e6bd45ee271b96e75484eeafea1b3e6139cd0c7 # main |
There was a problem hiding this comment.
Same conflict as build_documentation.yml: main (via #923) is already at e60a538 here, so re-pinning bcff59f→7e6bd45 conflicts on merge. Rebase and keep 7e6bd45.
| jobs: | ||
| build: | ||
| uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@bcff59fca682130d2e7271ca8589911b7ac0b8bf # main | ||
| uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@7e6bd45ee271b96e75484eeafea1b3e6139cd0c7 # main |
There was a problem hiding this comment.
This one merges cleanly — #923 didn't touch upload, so main is still at bcff59f. Clean +9-commit forward bump to doc-builder's main tip (7e6bd45); after rebase, all three pins re-unify at the same SHA.
1 participant
Summary
Aggregates the open non-env Dependabot workflow updates into one maintainer-owned PR.
Included single PRs:
huggingface/doc-builder/.github/workflows/upload_pr_documentation.ymlhuggingface/doc-builder/.github/workflows/build_pr_documentation.ymlhuggingface/doc-builder/.github/workflows/build_main_documentation.ymlChanged paths:
.github/workflows/upload_pr_documentation.yml.github/workflows/build_pr_documentation.yml.github/workflows/build_documentation.ymlValidation
git diff --check hf/main...HEADNo
src/files or Python dependency files are changed, so the core unit/integration test path was not run locally for this workflow-only rollup.