You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
build_pr_documentation.yml keys its concurrency group on github.head_ref, which is the head branch name without the fork owner. Two open PRs from different forks whose branches share a name therefore land in the same group, and a push on one cancels the in-flight doc build on the other.
Shared names are common, because many contributors push to their fork's default branch instead of creating one: 2 of the 36 currently open PRs here already share a head branch name, both on main. A doc build takes around 3 minutes, which is the window in which such a collision cancels a build. I did not find a realized cancellation in the 100 most recent runs, so this is hardening rather than a fix for something currently failing.
github.event.pull_request.number is unique per pull request. This workflow only triggers on pull_request, so the github.run_id fallback is never reached, but keeping it means that a later trigger would fall back to never cancelling rather than to grouping by branch name.
The template this workflow was copied from carries the same expression, and the same one-liner is proposed there in huggingface/doc-builder#829.
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.
Scanned 1 workflow file(s) with zizmor, pinact, OSV/GHSA, Claude, in full, as they stand on the default branch.
.github/workflows/build_pr_documentation.yml
🟡 MEDIUMref-version-mismatch — .github/workflows/build_pr_documentation.yml:14 (via zizmor)
action's hash pin has mismatched or missing version comment — branch points to commit cf20b09f2743
Fix: The # vX.Y.Z comment does not match the pinned SHA. Either the comment is stale or the pin was tampered with — re-resolve it.
🔵 LOWparse-error — .github/workflows/build_pr_documentation.yml:14 (via pinact)
pinact could not parse this file: failed to handle a line: SHA-pinned action requires a version comment for verifiability
Fix: Check the workflow YAML is valid.
Pinning and static findings are deterministic. Findings marked (via Claude) are model judgements — check them before acting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
build_pr_documentation.ymlkeys its concurrency group ongithub.head_ref, which is the head branch name without the fork owner. Two open PRs from different forks whose branches share a name therefore land in the same group, and a push on one cancels the in-flight doc build on the other.Shared names are common, because many contributors push to their fork's default branch instead of creating one: 2 of the 36 currently open PRs here already share a head branch name, both on
main. A doc build takes around 3 minutes, which is the window in which such a collision cancels a build. I did not find a realized cancellation in the 100 most recent runs, so this is hardening rather than a fix for something currently failing.github.event.pull_request.numberis unique per pull request. This workflow only triggers onpull_request, so thegithub.run_idfallback is never reached, but keeping it means that a later trigger would fall back to never cancelling rather than to grouping by branch name.The template this workflow was copied from carries the same expression, and the same one-liner is proposed there in huggingface/doc-builder#829.