chore(deps): bump huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to cf20b09f274383f0d91a7055c5e43f0a2ab3d1a3

[dependabot]

Bumps huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to cf20b09f274383f0d91a7055c5e43f0a2ab3d1a3.

Changelog

Sourced from huggingface/doc-builder/.github/workflows/build_pr_documentation.yml's changelog.

Release checklist

1. Checkout the release branch (for a patch the current release branch, for a new minor version, create one):

   git checkout -b vXX.xx-release

   The -b is only necessary for creation (so remove it when doing a patch).
2. Change the version in src/doc_builder/__init__.py and pyproject.toml to the proper value.
3. Commit these changes with the message: "Release: v<VERSION>".
4. Add a tag in git to mark the release:

   git tag v<VERSION> -m 'Adds tag v<VERSION> for pypi'

   Push the tag and release commit to git:

   git push --tags origin vXX.xx-release

5. Build the source distribution and the wheel in the top-level directory:

   rm -rf dist
   uv build

6. Upload the package to the pypi test server first:

   twine upload dist/* -r testpypi

7. Check that you can install it in a virtualenv by running:

   pip install hf-doc-builder
   pip uninstall hf-doc-builder
   pip install -i https://test.pypi.org/simple/ hf-doc-builder

   It's recommended to check that there are no issues building the docs, so try running a command like doc-builder.
8. Upload the final version to actual pypi:

   twine upload dist/* -r pypi

9. Add release notes to the tag in github once everything is looking hunky-dory.
10. Go back to the main branch and update the version in src/doc_builder/__init__.py and pyproject.toml to the new version ".dev" and push to main.

Commits

• cf20b09 Revert "Comment out schedule for search engine population (#826)" (#827)
• 9978a41 Comment out schedule for search engine population (#826)
• c2d27f6 Fix vectorless Meilisearch document payload (#825)
• 953aa44 Add vectorless full-text docs ingestion (#824)
• 1b16dac Remove setup.py in favor of pyproject.toml (#816)
• bcd143e Check anchors in links (#820)
• 68667a5 fix(kit): accept a lowercase region in language codes (pt-br) (#823)
• 0ab9ea0 Ship a pre-commit hook for doc-builder style (#818)
• 4a56e30 Escape HTML and strip ANSI codes in notebook-to-mdx text outputs (#819)
• da05e70 delete-old-prs: use a trusted publisher instead of the HF_ACCESS_TOKEN secret...
• Additional commits viewable in compare view

---

Note

Low Risk
Single CI workflow pin change with no application or runtime code touched; risk is limited to PR doc preview/build behavior if the upstream workflow regresses.

Overview
Updates the PR documentation GitHub Actions workflow to call a newer pinned revision of Hugging Face’s reusable build_pr_documentation.yml (7ccf6c0 → cf20b09). Inputs (commit_sha, pr_number, package: openenv, etc.) are unchanged; only the upstream workflow implementation moves forward (e.g. doc-builder fixes around link anchors, notebook MDX output, and related tooling from that commit range).

^{Reviewed by Cursor Bugbot for commit d661e9e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Dependabot bump of the SHA-pinned, HF-owned huggingface/doc-builder reusable workflow in build_pr_documentation.yml: 7ccf6c02 → 9978a413 (single uses: line).

Automated Checks

• Lint: PASS (N/A for scope) — 0 Python files changed; the CI lint job only covers src/+tests/ (neither touched) and TOML/YAML aren't linted. (lint.sh errors only because uv isn't installed on the review VM — pre-existing, unrelated to this PR.)
• Debug code: CLEAN — all check-debug.sh hits are pre-existing src/openenv/core/mcp_client.py prints + cli/serve/__main__/test_local_docker_provider TODOs; none are in this diff.
• YAML: valid (yaml.safe_load OK).

Supply-chain / caller-contract verification

• New SHA legitimate & current: 7ccf6c02...9978a413 is a clean fast-forward (ahead 15 / behind 0); 9978a413...main == identical, so the new pin is doc-builder's current main HEAD and the trailing # main comment stays accurate. New tip = doc-builder #826 "Comment out schedule for search engine population".
• Reusable-workflow interface changed but backward-compatible: unlike most prior bumps, build_pr_documentation.yml is in the compare's changed files. Its only delta is doc-builder #808 — an optional python_version input (type: string, no required:, no default:) plus a uv venv … line that is byte-identical when the input is unset. The workflow_call required inputs at 9978a413 remain exactly commit_sha/pr_number/package. Our caller supplies all three (+ version_tag_suffix: "") and does not pass python_version, so it keeps the runner's system Python — no new required input, nothing breaks. build_pr has no secrets: block and our caller passes none.
• Artifact contract intact: the patch doesn't touch the upload step, so the doc-build-artifact handoff to upload_pr_documentation.yml is unchanged.
• Security: still a full 40-char SHA pin; no hardcoded credentials.
• Mergeability: git merge-tree origin/main <head> is clean (origin/main tip ced9d73c == PR base == merge-base → clean 1-commit fast-forward); no stale-branch conflict.

Open RFCs Context

rfcs/ = 000/001/002/003/005/008 (In Review), 004-rubrics (no Status header), 010 (Draft). None govern CI / GitHub Actions / dependency management / the docs-build pipeline → no RFC conflicts.

Tier 1: Fixes Required

None.

Tier 2: Alignment Discussion

Principle Conflicts — None identified. A CI workflow SHA bump touches no runtime API / reward / client-server / MCP-WS / credential surface; full-SHA pinning + dependabot freshness aligns with the reproducibility/security principle.

RFC Conflicts — None identified.

Non-blocking note (informational)

• Sibling pin skew (expected): the sibling doc-builder pins are still at 7ccf6c02 — build_documentation.yml:12 (build_main) and upload_pr_documentation.yml:11. Dependabot tracks each reusable-workflow path as a separate dependency, so temporary skew is expected and reconverges as the sibling PRs (or a codex/dependabot-core-* aggregate) land. cc @burtenshaw (owner of .github/). Not a blocker.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts

Clean, low-risk first-party bump. LGTM.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Verified this bump. 7ccf6c02…9978a413 is a clean fast-forward (ahead 15 / behind 0) and 9978a413 == doc-builder main HEAD, so the # main comment stays accurate.

The reusable workflow's only interface change across the delta is doc-builder #808's optional python_version input (no required:, no default:; the uv venv line is byte-identical when it's unset). Required workflow_call inputs remain commit_sha/pr_number/package — all supplied by this caller — so the contract is unbroken and the runner's system Python is retained. Full 40-char SHA pin preserved.

[dependabot]

Looks like huggingface/doc-builder/.github/workflows/build_pr_documentation.yml is up-to-date now, so this is no longer needed.