chore(deps): bump huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from cf20b09f274383f0d91a7055c5e43f0a2ab3d1a3 to 9f9bb430a712b5650d0e43e510656098ecdd75d4

[dependabot]

Bumps huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from cf20b09f274383f0d91a7055c5e43f0a2ab3d1a3 to 9f9bb430a712b5650d0e43e510656098ecdd75d4.

Changelog

Sourced from huggingface/doc-builder/.github/workflows/build_pr_documentation.yml's changelog.

Release checklist

1. Checkout the release branch (for a patch the current release branch, for a new minor version, create one):

   git checkout -b vXX.xx-release

   The -b is only necessary for creation (so remove it when doing a patch).
2. Change the version in src/doc_builder/__init__.py and pyproject.toml to the proper value.
3. Commit these changes with the message: "Release: v<VERSION>".
4. Add a tag in git to mark the release:

   git tag v<VERSION> -m 'Adds tag v<VERSION> for pypi'

   Push the tag and release commit to git:

   git push --tags origin vXX.xx-release

5. Build the source distribution and the wheel in the top-level directory:

   rm -rf dist
   uv build

6. Upload the package to the pypi test server first:

   twine upload dist/* -r testpypi

7. Check that you can install it in a virtualenv by running:

   pip install hf-doc-builder
   pip uninstall hf-doc-builder
   pip install -i https://test.pypi.org/simple/ hf-doc-builder

   It's recommended to check that there are no issues building the docs, so try running a command like doc-builder.
8. Upload the final version to actual pypi:

   twine upload dist/* -r pypi

9. Add release notes to the tag in github once everything is looking hunky-dory.
10. Go back to the main branch and update the version in src/doc_builder/__init__.py and pyproject.toml to the new version ".dev" and push to main.

Commits

• 9f9bb43 fix(ci): harden workflow files flagged on #830 (#832)
• 17ccdf1 chore: enable Dependabot weekly GitHub Actions bumps (#790)
• 47c6b58 fix(ci): pin the doc-builder checkout to the caller's pinned revision (#830)
• See full diff in compare view

---

Note

Low Risk
Single SHA bump for a documentation CI workflow with no application or security-sensitive runtime code changes.

Overview
Updates the reusable PR documentation workflow pin from cf20b09 to 9f9bb43 on huggingface/doc-builder, aligning this repo with upstream CI fixes (workflow hardening and pinning doc-builder checkout to the caller’s revision).

Behavior for openenv PRs is unchanged at the inputs level (commit_sha, pr_number, package, version_tag_suffix); only which upstream workflow revision runs changes.

^{Reviewed by Cursor Bugbot for commit ce71606. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Dependabot bump of the pinned huggingface/doc-builder/.github/workflows/build_pr_documentation.yml reusable workflow: cf20b09f → 9f9bb430 (single line, build_pr_documentation.yml:13, # main retained).

Automated Checks

• Lint: PASS (N/A) — uv isn't installed on the review VM, so .claude/hooks/lint.sh exits immediately ('uv' is not installed). It's a Python-only hook that doesn't cover .github/ anyway; this YAML-only diff adds no lint surface. Working tree stayed pristine.
• Debug code: CLEAN — check-debug.sh hits are all pre-existing src/ items (generic_client.py docstring print(...) examples, harness/collect.py console.print, TODOs under cli/); none are in this diff.
• YAML: yaml.safe_load OK.

Verification

• SHAs real + clean forward bump: cf20b09f…9f9bb430 = ahead 3 / behind 0 (clean fast-forward). New SHA == doc-builder main tip (9f9bb430…main identical), so the # main annotation is accurate. Delta = doc-builder #830 (pin checkout to the caller's pinned revision) + #790 (enable Dependabot) + #832 (harden workflow files).
• Interface compat — no break: the reusable workflow's own definition changed in this delta, but only internally. workflow_call required inputs are unchanged (commit_sha, pr_number, package); no new required input; no secrets: block. OpenEnv's caller (build_pr_documentation.yml:13-18) passes commit_sha / pr_number / package: openenv / version_tag_suffix: "" — all required inputs satisfied. doc_builder_revision lost its default: "main" (it now defaults to the caller's pinned SHA via job.workflow_sha); OpenEnv doesn't pass that input, so behavior is unchanged — strictly a hardening improvement.
• Security-positive: the new revision pins the doc-builder checkout to the caller's pinned SHA (no more floating main), adds permissions: {} + job contents: read, sets persist-credentials: false, and moves ${{ inputs.* }} interpolations into env: vars (script-injection hardening). No hardcoded credentials.
• Merge state: branch is 1 commit behind main (Miles docs #1220, which doesn't touch this file); git merge-tree against origin/main is clean and the net merge effect is exactly this 1-line bump. Non-blocking.

Open RFCs Context

rfcs/ = 000/001/002/003/005/008/012 (In Review), 010/011 (Draft), 004 (no status header, Rubrics). None govern CI / GitHub Actions / doc-build / dependency management → no RFC surface for this change.

Tier 1: Fixes Required

None.

Tier 2: Alignment Discussion

Principle Conflicts

None identified — PRINCIPLES.md / INVARIANTS.md govern the runtime API (Gym reset/step/state, MCP boundary, rewards-in-environment, client-server separation, credential exposure). A CI SHA bump touches none of them.

RFC Conflicts

None identified.

FYI (non-blocking)

• Sibling pin skew (expected): this makes build_pr lead @9f9bb430 while build_documentation.yml:12 (build_main) and upload_pr_documentation.yml:11 (upload) still sit at @cf20b09f. Dependabot tracks each reusable-workflow path separately, so temporary skew is normal and converges as the sibling PRs (or an aggregate roll-up) merge. No action needed in this single-path PR.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts

Owner for .github/ workflows + dependabot.yml: @burtenshaw.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Verified this bump: cf20b09f → 9f9bb430 is a clean forward bump (ahead 3 / behind 0) and 9f9bb430 == doc-builder main tip, so # main is accurate.

No break: the reusable workflow's workflow_call required inputs are unchanged (commit_sha, pr_number, package) and there's no secrets: block — this caller supplies all required inputs (version_tag_suffix is optional). doc_builder_revision dropped its default: "main" and now defaults to the caller's pinned SHA (job.workflow_sha); OpenEnv doesn't pass it, so behavior is unchanged.

Security-positive: the new revision pins the doc-builder checkout to the caller's pinned SHA instead of floating main, adds permissions: {} + job contents: read, sets persist-credentials: false, and moves inputs into env: vars (script-injection hardening).

[cursor]

APPROVE at ce716062 (refreshed onto main da6c0276). This is the last of the three doc-builder pins, after #1223 and #1225.

Upstream verification

huggingface/doc-builder@9f9bb430a712b5650d0e43e510656098ecdd75d4 is the current tip of upstream main: fix(ci): harden workflow files flagged on #830 (#832).

The diff of build_pr_documentation.yml between cf20b09f and 9f9bb430 is the same hardening shape as #1225: top-level permissions: {} with per-job contents: read, every ${{ inputs.* }} moved out of run: bodies into env: variables, persist-credentials: false, and the doc-builder checkout changed from an unref'd huggingface/doc-builder to repository: ${{ job.workflow_repository }} with ref: ${{ inputs.doc_builder_revision || job.workflow_sha }}.

One behaviour change worth naming

The doc_builder_revision input default changes from "main" to empty. Previously an unset value meant the doc-builder code was pulled from the default branch regardless of the SHA we pinned in uses:; now it falls back to job.workflow_sha, so our pin governs the code as well as the YAML. build_pr_documentation.yml in this repository does not pass doc_builder_revision, so the practical effect is that PR doc builds become reproducible against the pinned revision instead of tracking upstream main. That is the intent of the change and an improvement.

Direct evidence

Unlike #1225, this workflow runs in its own PR context, so the new pin actually executed here: build / build_pr_documentation is green at this head against this repository's docs/source. That run is also the evidence I relied on when approving #1225, since the main-docs workflow cannot be exercised from a PR.

Workflow-only; not 0.6.0 package cargo. All 11 exact-head checks green and the branch is up to date with main.

  

_{Sent by Cursor Automation: Release}

[cursor]

Approved at ce716062.

• Exact-head checks are green, including tests, package smoke, lint, CodeQL, docs, and Bugbot.
• The net change is the verified one-line build_pr_documentation.yml reusable-workflow pin; its required inputs are unchanged and the upstream revision is a clean forward update.
• Workflow-only: no package bytes change. If merged before the cut, draft #1211 needs one exact-main refresh/CI pass, but TestPyPI 0.6.0.dev91 remains valid.

View PR

  

_{Sent by Cursor Automation: Release}