chore(deps): bump huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 6dd1bdab58a8564730f633d70e76bb1ef57ec627

[dependabot]

Bumps huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 6dd1bdab58a8564730f633d70e76bb1ef57ec627.

Commits

• 6dd1bda Preserve Markdown callout blockquote lines in docbuilder style docstring fo...
• 931031b Add python_version input to doc build workflows (#808)
• 9a49534 fix(kit): escape curly braces in markdown link & image URLs (#812)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Single SHA pin change for PR doc upload only; no application or secret handling logic changes in this repo.

Overview
Updates the reusable workflow reference in Upload PR Documentation from huggingface/doc-builder commit 7ccf6c0 to 6dd1bdab.

That upstream revision includes docstring/callout formatting fixes, a python_version workflow input, and markdown URL escaping in the doc-builder kit. Build and main documentation workflows are unchanged and still pin the older SHA.

^{Reviewed by Cursor Bugbot for commit 117700c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Dependabot bump of the HF-owned doc-builder reusable workflow pinned in .github/workflows/upload_pr_documentation.yml: upload_pr_documentation.yml@7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c → @6dd1bdab58a8564730f633d70e76bb1ef57ec627 (single uses: line, # main retained). Supersedes last week's #1075 (its target 931031bf is the middle commit of this delta) with one newer commit.

Automated Checks

• Lint: PASS (N/A for scope) — 0 Python files changed (workflow-YAML-only diff); .claude/hooks/lint.sh only lints Python and errored with 'uv' is not installed on the review VM — irrelevant here. .yml/.toml/.lock aren't linted at all. yaml.safe_load() on the changed file → valid YAML.
• Debug code: CLEAN — check-debug.sh scans src/ only and reports pre-existing console.print (rich CLI output) + TODOs in cli/commands/init.py, cli/__main__.py, cli/commands/serve.py, containers/test_local_docker_provider.py; none in this PR's diff. No debugger statements.

Open RFCs Context

On main: 000-project-phases, 001-abstractions, 002-env-spec, 003-mcp-support, 004-rubrics (In Review), 005-agentic-harnesses (In Review), 010-echo-env-token-world-model (Draft). None govern CI, GitHub Actions, the doc-build pipeline, or dependency management → no RFC surface for a doc-builder SHA bump.

Verification performed

• New SHA legitimate + current: 7ccf6c02...6dd1bdab = clean fast-forward (ahead 3 / behind 0); 6dd1bdab...main = identical → 6dd1bdab is doc-builder main HEAD, so the trailing # main comment stays accurate. The 3 commits: #812 (mdsvex curly-brace escape), #808 (adds an optional python_version input to the build workflows, not upload), #756 (style_doc.py callout-preservation fix).
• Caller contract safe: the compare's changed files are build_main_documentation.yml, build_pr_documentation.yml, kit/preprocessors/mdsvex/index.js, src/doc_builder/style_doc.py, tests/test_style_doc.py — upload_pr_documentation.yml is NOT among them, i.e. the reusable workflow this file calls is byte-identical across the delta, so its workflow_call inputs/secrets are unchanged. OpenEnv's caller supplies required package_name: openenv + hf_token(←HF_DOC_BUILD_PUSH) + optional comment_bot_app_id/comment_bot_secret_pem, all as secrets.* refs → won't break, no hardcoded credentials.
• Security / pinning: still pinned to a full 40-char commit SHA → supply-chain pinning preserved.
• Mergeability: git merge-tree origin/main <head> is clean (no conflict); main tip 5359534c == merge-base == PR base → clean 1-commit fast-forward.

Tier 1: Fixes Required

None.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. No runtime API / reward / client-server / MCP surface is touched; credentials remain secrets.* references (no exposure).

RFC Conflicts

None identified. No RFC covers CI / GitHub Actions / doc-build / dependency management.

Non-blocking notes

• Sibling pin skew (informational, cc @burtenshaw): after merge, upload_pr_documentation.yml:11 is @6dd1bdab while build_pr_documentation.yml:13 and build_documentation.yml:12 stay @7ccf6c02 (they were uniform @7ccf6c02 on main). Dependabot tracks each reusable-workflow path separately, so this temporary skew is expected and reconverges as the sibling bumps (or a codex aggregate) land — not a bug.
• The github-actions updater in .github/dependabot.yml has no exclude-paths, so this bump is fully in-scope/intended.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Clean, zero-risk first-party (HF-owned doc-builder) reusable-workflow SHA bump to current main HEAD.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Clean forward bump to doc-builder main HEAD: 7ccf6c02...6dd1bdab = ahead 3 / behind 0, and 6dd1bdab...main = identical, so # main stays accurate. Crucially, the compare's changed files do not include upload_pr_documentation.yml, so this reusable workflow is byte-identical across the delta → its workflow_call inputs/secrets are unchanged and the caller's package_name/hf_token/comment_bot_* remain valid. Full 40-char SHA pin retained.

[dependabot]

Superseded by #1088.