chore(deps): bump huggingface/doc-builder/.github/workflows/build_main_documentation.yml from 6108e850ae1cf2f71bb0815a600bcd50c39abfa7 to 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c

[dependabot]

Bumps huggingface/doc-builder/.github/workflows/build_main_documentation.yml from 6108e850ae1cf2f71bb0815a600bcd50c39abfa7 to 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c.

Commits

• 7ccf6c0 fix(ci): read _versions.yml from the serving bucket (#811)
• 23dc84b Fix .md export losing method names, signatures and section labels (#810)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Single SHA bump in a docs-only CI workflow with no application or auth logic changes.

Overview
Updates the main documentation GitHub Actions job to call a newer pinned commit of huggingface/doc-builder’s build_main_documentation.yml reusable workflow.

The only in-repo change is swapping the workflow ref from 6108e850… to 7ccf6c02…; job inputs (package: openenv, commit_sha, secrets) are unchanged. Upstream at that ref includes CI fixes around reading _versions.yml from the serving bucket and improvements to .md export (method names, signatures, section labels).

^{Reviewed by Cursor Bugbot for commit 79f7680. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Dependabot bump of the huggingface/doc-builder main-docs reusable-workflow pin in .github/workflows/build_documentation.yml (line 12): build_main_documentation.yml@6108e850 → @7ccf6c02. Single-line, first-party (HF-owned) workflow SHA bump.

Automated Checks

• Lint: PASS (N/A for this PR's scope). The diff changes only a workflow YAML (0 .py files), and YAML isn't linted. .claude/hooks/lint.sh exits 1 solely on ~25 pre-existing envs/** formatting-drift files (ruff reformatting Python code fences embedded in READMEs) — none are in this PR; ruff check src/ tests/ passes clean.
• Debug code: CLEAN. check-debug.sh scans src/ only; every hit is pre-existing and unrelated (no changed file is involved).

Open RFCs Context

Active RFCs: 000/001/002/003/005 In Review, 010 Draft, 004 (rubrics, no status header). None govern CI, GitHub Actions, dependency management, or the docs-build pipeline → no RFC is relevant to this change.

doc-builder SHA bump verification

• ✅ Legitimate & current: 6108e850...7ccf6c02 is a clean fast-forward (ahead 2, behind 0), and 7ccf6c02 is identical to huggingface/doc-builder@main HEAD, so the trailing # main comment stays accurate. The two commits are doc-builder #810 (fix .md export losing method names/signatures) and #811 (fix(ci): read _versions.yml from the serving bucket).
• ✅ Caller contract intact: unlike the recent byte-identical doc-builder bumps, the called build_main_documentation.yml did change here — but only internally: the "Create build directory" step now fetches _versions.yml via uvx … hf cp "hf://buckets/hf-doc-build/doc/<pkg>/_versions.yml" instead of wget off the legacy dataset (#811). The on: workflow_call: interface is byte-identical at both SHAs (the sole patch hunk is at L150, well below the inputs/secrets block). This caller supplies all required inputs (commit_sha, package: openenv) plus the required secret hf_token (← secrets.HF_DOC_BUILD_PUSH) and optional version_tag_suffix: "". No new required input/secret was introduced ⇒ the reusable workflow won't fail to start.
• ✅ Security: still pinned to a full 40-char SHA (not a tag/branch); hf_token remains a secrets.* reference (no credential exposure).
• ✅ Stale-branch / merge: git merge-tree origin/main <head> is clean (exit 0, no conflict); origin/main tip == PR base == merge-base ⇒ a clean 1-commit fast-forward (no #930-style stale-branch conflict).

Tier 1: Fixes Required

None.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. Keeping a full-SHA pin current aligns with the reproducibility/security principle (.claude/docs/PRINCIPLES.md "Container isolation…", authored by @Darktex).

RFC Conflicts

None identified (no RFC covers CI / GitHub Actions / the docs-build pipeline).

Non-blocking notes

• Sibling-pin skew (informational, cc @burtenshaw): the other two doc-builder pins remain at 6108e850 — upload_pr_documentation.yml:11 and build_pr_documentation.yml:13. The github-actions dependabot updater treats each workflow path as a separate dependency, so those arrive as their own PRs (or a codex/dependabot-core-* aggregate). Temporary skew is expected; the pins reconverge once those land.
• Unlike recent doc-builder bumps, this one is not a no-op: #811 changes how the main docs build resolves the served version list (served bucket vs. legacy dataset), which is net-positive (prevents hf.co/docs/openenv from 404ing on its default version). The behavioral change is internal to doc-builder and interface-safe for OpenEnv.
• .github/dependabot.yml's github-actions updater has no exclude-paths, so this bump is fully in-scope/intended (the exclude-paths process note that applies to native uv env-lock PRs does not apply here).

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Clean, first-party doc-builder bump — safe to merge once CI passes.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

build_main_documentation.yml 6108e850 → 7ccf6c02: clean fast-forward (ahead 2 / behind 0) and identical to doc-builder main HEAD, so # main stays accurate.

Caller contract verified safe: the called workflow changed only internally (doc-builder #811 reads _versions.yml from the served bucket via uvx hf cp instead of wget; #810 fixes .md export). The on: workflow_call: inputs/secrets are byte-identical at both SHAs, so this caller's commit_sha / package / version_tag_suffix / hf_token remain valid — no new required input or secret. Still a full-SHA pin. ✅

[burtenshaw]

Closing in favor of aggregate non-env Dependabot PR #1069.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.