chore(deps): bump huggingface/doc-builder/.github/workflows/build_main_documentation.yml from cf20b09f274383f0d91a7055c5e43f0a2ab3d1a3 to 9f9bb430a712b5650d0e43e510656098ecdd75d4

[dependabot]

Bumps huggingface/doc-builder/.github/workflows/build_main_documentation.yml from cf20b09f274383f0d91a7055c5e43f0a2ab3d1a3 to 9f9bb430a712b5650d0e43e510656098ecdd75d4.

Changelog

Sourced from huggingface/doc-builder/.github/workflows/build_main_documentation.yml's changelog.

Release checklist

1. Checkout the release branch (for a patch the current release branch, for a new minor version, create one):

   git checkout -b vXX.xx-release

   The -b is only necessary for creation (so remove it when doing a patch).
2. Change the version in src/doc_builder/__init__.py and pyproject.toml to the proper value.
3. Commit these changes with the message: "Release: v<VERSION>".
4. Add a tag in git to mark the release:

   git tag v<VERSION> -m 'Adds tag v<VERSION> for pypi'

   Push the tag and release commit to git:

   git push --tags origin vXX.xx-release

5. Build the source distribution and the wheel in the top-level directory:

   rm -rf dist
   uv build

6. Upload the package to the pypi test server first:

   twine upload dist/* -r testpypi

7. Check that you can install it in a virtualenv by running:

   pip install hf-doc-builder
   pip uninstall hf-doc-builder
   pip install -i https://test.pypi.org/simple/ hf-doc-builder

   It's recommended to check that there are no issues building the docs, so try running a command like doc-builder.
8. Upload the final version to actual pypi:

   twine upload dist/* -r pypi

9. Add release notes to the tag in github once everything is looking hunky-dory.
10. Go back to the main branch and update the version in src/doc_builder/__init__.py and pyproject.toml to the new version ".dev" and push to main.

Commits

• 9f9bb43 fix(ci): harden workflow files flagged on #830 (#832)
• 17ccdf1 chore: enable Dependabot weekly GitHub Actions bumps (#790)
• 47c6b58 fix(ci): pin the doc-builder checkout to the caller's pinned revision (#830)
• See full diff in compare view

---

Note

Low Risk
Single CI workflow SHA bump with no application or secret changes; risk is limited to documentation build behavior on push to main/doc-builder/release branches.

Overview
Updates the reusable Build documentation workflow to pin huggingface/doc-builder’s build_main_documentation.yml from cf20b09… to 9f9bb43…. Inputs (package: openenv, commit_sha, secrets) are unchanged; only the upstream workflow revision moves forward (includes doc-builder CI hardening and checkout pinning fixes per upstream commits).

^{Reviewed by Cursor Bugbot for commit f200b95. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Automated Checks

• Lint: PASS (for this PR's scope) — this PR changes 0 Python files, so the src//tests//envs/ lint pipeline isn't exercised by it. Tree baseline (tools run standalone because .claude/hooks/lint.sh needs uv, absent in the review sandbox): ruff check clean; usort flags only tests/envs/test_grid_world.py and tests/envs/test_julia_env.py, which AGENTS.md documents as pre-existing and unrelated to this change.
• Debug code: CLEAN (for this PR) — check-debug.sh findings are all pre-existing print/TODO lines in src/; this PR introduces none.

What changed

Single-line Dependabot bump of the pinned SHA for the reusable huggingface/doc-builder main-docs workflow in .github/workflows/build_documentation.yml:
build_main_documentation.yml@cf20b09… → @9f9bb43…

Supply-chain verification (GitHub API):

• ✅ New SHA 9f9bb430… is a real commit in huggingface/doc-builder (2026-09-21); the referenced workflow file exists at that SHA.
• ✅ compare cf20b09…9f9bb43 → ahead_by 3, behind_by 0 = clean fast-forward on the same history (not a divergent/hijacked ref).
• ✅ The target commit is itself a CI-hardening change: fix(ci): harden workflow files flagged on #830 (#832).
• ✅ Reference remains SHA-pinned (immutable), not a mutable tag/branch — best practice preserved.
• ✅ Workflow YAML still parses; the # main comment and secrets.hf_token wiring are unchanged. No credential exposure introduced.

Open RFCs Context

Active RFCs — Draft: 010 (echo-env token world model), 011 (ard-catalog-discovery); In Review: 000, 001, 002, 003, 005, 008, 012. None touch documentation CI, doc-builder, or GitHub Actions, so none are relevant to this change.

Tier 1: Fixes Required

None. (No Python touched; YAML valid; no lint/debug/security issues introduced.)

Tier 2: Alignment Discussion

Principle Conflicts

None identified. A docs-CI workflow SHA bump does not touch environment design (rewards-in-environment, Gymnasium API, MCP boundary, client↔server separation, etc.).

RFC Conflicts

None identified.

Minor note (non-blocking)

The companion .github/workflows/build_pr_documentation.yml still pins the older doc-builder SHA cf20b09… (it uses the sibling build_pr_documentation.yml reusable workflow). After this PR the two doc-builder pins are temporarily out of lockstep. This is expected Dependabot behavior (one PR per reusable workflow) and is normally reconciled by a separate PR — noted for awareness only; no action needed here.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Automated dependency bump; new SHA verified as legitimate and security-positive. No blocking issues.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

✅ SHA verified. 9f9bb430… is a real huggingface/doc-builder commit (2026-09-21), a clean fast-forward of the previous pin (ahead 3 / behind 0), and the target is a CI-hardening commit (fix(ci): harden workflow files… #832). Still SHA-pinned — good.

Minor: build_pr_documentation.yml still pins the older cf20b09…, so the two doc-builder pins are temporarily out of lockstep (expected — separate Dependabot PR).

[cursor]

APPROVE at f200b957 (refreshed onto main 98abcad4).

Upstream verification

huggingface/doc-builder@9f9bb430a712b5650d0e43e510656098ecdd75d4 is the current tip of doc-builder's main (compare reports identical): fix(ci): harden workflow files flagged on #830 (#832).

Unlike #1223, the referenced workflow does change between the two pins, so I diffed build_main_documentation.yml at cf20b09f and 9f9bb430. Everything in it is hardening:

• Top-level permissions: {} with an explicit per-job contents: read.
• Every ${{ inputs.* }} interpolation moved out of run: bodies and into env: variables, closing the usual script-injection surface.
• persist-credentials: false on the doc-builder checkout.
• The doc-builder checkout is now repository: ${{ job.workflow_repository }} / ref: ${{ job.workflow_sha }} instead of a bare huggingface/doc-builder with no ref. This is the substantive fix: previously our @<sha> pin only governed the YAML, while the code that ran with the build secrets came from doc-builder's default branch. Now our pin governs both.

Contract compatibility with our caller

build_documentation.yml passes commit_sha, package, version_tag_suffix, and the hf_token secret. All four are still declared at the new pin with the same types, and hf_token is still required: true. Nothing we pass was renamed or removed.

Residual risk, and why I am accepting it

This reusable workflow only runs on pushes to main, so it cannot be exercised from a PR context the way #1226 can. The mitigation is that #1226 pins the same doc-builder revision for the PR docs build and that build completed successfully against this repository's docs/source, so the pinned revision is known to build our docs. Worst case here is that main-docs publishing fails after merge, which is recoverable and touches nothing in the package.

Workflow-only; not 0.6.0 package cargo. All 11 exact-head checks green and the branch is up to date with main.

  

_{Sent by Cursor Automation: Release}