[dependabot]

Bumps huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from cf20b09f274383f0d91a7055c5e43f0a2ab3d1a3 to 9f9bb430a712b5650d0e43e510656098ecdd75d4.

Changelog

Sourced from huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml's changelog.

Release checklist

1. Checkout the release branch (for a patch the current release branch, for a new minor version, create one):

   git checkout -b vXX.xx-release

   The -b is only necessary for creation (so remove it when doing a patch).
2. Change the version in src/doc_builder/__init__.py and pyproject.toml to the proper value.
3. Commit these changes with the message: "Release: v<VERSION>".
4. Add a tag in git to mark the release:

   git tag v<VERSION> -m 'Adds tag v<VERSION> for pypi'

   Push the tag and release commit to git:

   git push --tags origin vXX.xx-release

5. Build the source distribution and the wheel in the top-level directory:

   rm -rf dist
   uv build

6. Upload the package to the pypi test server first:

   twine upload dist/* -r testpypi

7. Check that you can install it in a virtualenv by running:

   pip install hf-doc-builder
   pip uninstall hf-doc-builder
   pip install -i https://test.pypi.org/simple/ hf-doc-builder

   It's recommended to check that there are no issues building the docs, so try running a command like doc-builder.
8. Upload the final version to actual pypi:

   twine upload dist/* -r pypi

9. Add release notes to the tag in github once everything is looking hunky-dory.
10. Go back to the main branch and update the version in src/doc_builder/__init__.py and pyproject.toml to the new version ".dev" and push to main.

Commits

• 9f9bb43 fix(ci): harden workflow files flagged on #830 (#832)
• 17ccdf1 chore: enable Dependabot weekly GitHub Actions bumps (#790)
• 47c6b58 fix(ci): pin the doc-builder checkout to the caller's pinned revision (#830)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Only changes which reusable workflow SHA runs for PR documentation upload; no application or secrets logic changes in this repo.

Overview
Updates the Upload PR Documentation workflow to call a newer pinned revision of huggingface/doc-builder's reusable upload_pr_documentation.yml workflow.

The upstream bump includes CI hardening for flagged workflow files and pinning the doc-builder checkout to the same revision the caller pins, so PR doc upload behavior should stay aligned with the chosen SHA while picking up those fixes.

^{Reviewed by Cursor Bugbot for commit 5f21271. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Scope: one-line change in .github/workflows/upload_pr_documentation.yml bumping the pinned reusable-workflow SHA huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from cf20b09 -> 9f9bb43. No src/, tests/, or envs/ code is touched.

Automated Checks

• Lint (.claude/hooks/lint.sh): exits non-zero, but only from pre-existing formatting drift in src//tests//envs/ (ruff-format: "56 files would be reformatted, 846 already formatted"; usort flags several more). This matches the known clean-tree lint state documented in AGENTS.md. usort/ruff do not scan workflow YAML, and I confirmed the changed file is not among the flagged paths. No new lint issues are introduced by this PR.
• Debug code (.claude/hooks/check-debug.sh): only pre-existing print/TODO hits in src/ (docstrings, CLI output, a local test harness). None are in this diff. Clean.

Supply-chain verification (the substance of this PR)

This pin feeds repo secrets (an HF doc-build push token + comment-bot credentials) into the reusable workflow, so I verified the new revision against huggingface/doc-builder via the GitHub API:

• 9f9bb43 exists and is the current tip of doc-builder@main (compare 9f9bb43...main = identical), so the trailing # main comment is accurate.
• It was authored by hf-security-analysis[bot] — "fix(ci): harden workflow files flagged on #830 (#832)", i.e. a security-hardening commit.
• The consumed file upload_pr_documentation.yml is unchanged between old and new; the 3-commit drift only touches dependabot.yml, build_main_documentation.yml, and build_pr_documentation.yml.
• The full 40-char SHA pin is preserved (best practice, not a mutable tag).

Net result: legitimate, low-risk, and positive for security.

Open RFCs Context

Active RFCs — 000/001/002/003/005/008/012 (In Review) and 010/011 (Draft) — cover core APIs, abstractions, rewards, agentic harnesses, validation, world-modeling, and discovery. None relate to docs-build CI, so there is no overlap with this change.

Tier 1: Fixes Required

None. The pre-existing lint drift is out of scope for a dependency bump — reformatting 50+ unrelated files in this PR would be inappropriate scope creep.

Tier 2: Alignment Discussion

Principle conflicts: None identified — no change to the Gymnasium-style API, client/server separation, reward placement, MCP boundary, or type/serialization contracts.

RFC conflicts: None identified.

Non-blocking note

The sibling pins in build_documentation.yml and build_pr_documentation.yml still reference the old cf20b09. Dependabot opens one PR per referenced workflow, so companion PRs should follow; interim mixed SHAs across these independent reusable workflows are harmless.

Summary

• 0 mechanical issues to fix (all lint/debug findings are pre-existing and out-of-scope)
• 0 alignment points for human review
• 0 RFC conflicts
• Verified safe bump to the current doc-builder@main security-hardening commit.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Verified this new pin against huggingface/doc-builder:

• 9f9bb43 is the current tip of doc-builder@main (compare 9f9bb43...main = identical), so the # main comment is accurate.
• It is a security-hardening commit by hf-security-analysis[bot] (fix(ci): harden workflow files flagged on #830 (#832)).
• The consumed upload_pr_documentation.yml is unchanged vs the old cf20b09; only dependabot.yml and the two build_* workflows differ across the 3-commit gap.
• Full 40-char SHA pin preserved.

This workflow forwards repo secrets (HF push token + comment-bot credentials) to the reusable workflow, so the pin update matters — and it checks out as safe.

[cursor]

APPROVE at 5f212718 (refreshed onto main ca4219d2).

Upstream verification

huggingface/doc-builder@9f9bb430a712b5650d0e43e510656098ecdd75d4 is the current tip of doc-builder's main (compare reports identical), and the commit is fix(ci): harden workflow files flagged on #830 (#832).

I diffed the referenced reusable workflow at both pins: .github/workflows/upload_pr_documentation.yml is byte-identical between cf20b09f and 9f9bb430 (sha256 742ca4cd53ff471b at both). So this PR moves the pin forward without changing a single line of the privileged workflow that receives hf_token, comment_bot_app_id, and comment_bot_secret_pem. The secrets: and with: contract our caller passes is unchanged.

Workflow-only; no wheel or sdist input changes, so this is not 0.6.0 package cargo. All 11 exact-head checks are green and the branch is up to date with main.

  

_{Sent by Cursor Automation: Release}