chore(deps): bump huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from 6108e850ae1cf2f71bb0815a600bcd50c39abfa7 to 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c

[dependabot]

Bumps huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml from 6108e850ae1cf2f71bb0815a600bcd50c39abfa7 to 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c.

Commits

• 7ccf6c0 fix(ci): read _versions.yml from the serving bucket (#811)
• 23dc84b Fix .md export losing method names, signatures and section labels (#810)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Single-line workflow dependency pin with no application or secret changes; risk is limited to PR documentation upload CI behavior.

Overview
Updates the pinned reusable workflow for uploading PR documentation from huggingface/doc-builder to commit 7ccf6c02.

The Upload PR Documentation job still delegates to the same upstream workflow with package_name: openenv and the existing HF/comment-bot secrets; only the referenced SHA changes. The new pin includes upstream fixes for CI reading _versions.yml from the serving bucket and for .md export preserving method names, signatures, and section labels.

^{Reviewed by Cursor Bugbot for commit a13cbb1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Scope: 1 file changed, +1/-1 — .github/workflows/upload_pr_documentation.yml. This is a GitHub Actions SHA-pin bump (6108e85 → 7ccf6c0) for the reusable huggingface/doc-builder doc-upload workflow. No Python, framework, client/server, or environment code is touched.

Automated Checks

• Lint: FAIL — but pre-existing and unrelated to this PR. .claude/hooks/lint.sh flags formatting drift in envs/* Python files and in Python code blocks embedded in several envs/*/README.md, all present on main independent of this change. This PR changes only a YAML workflow file (zero Python), so it introduces no new lint issues.
• Debug code: CLEAN for this PR. .claude/hooks/check-debug.sh only surfaces items outside this diff (Rich console.print(...) calls in src/openenv/cli/commands/push.py, plus three pre-existing TODO comments). Nothing is introduced here.

Supply-chain verification (GitHub Actions bump)

Verified the new pin against upstream huggingface/doc-builder:

• Pinned to a full 40-char commit SHA (immutable), not a mutable tag — recommended practice.
• 7ccf6c0 is a real commit — "fix(ci): read _versions.yml from the serving bucket (#811)", authored by maintainer @XciD, merged via GitHub.
• 7ccf6c0 is identical to doc-builder@main HEAD, so the trailing # main comment is accurate.
• Clean forward bump: the new SHA is exactly 2 commits ahead of the old pin and 0 behind (no divergence or history rewrite).
• The old→new delta does not modify the upload_pr_documentation.yml reusable workflow this repo calls (only build_main_documentation.yml, src/doc_builder/utils.py, and tests/test_utils.py), so the called workflow's behavior is unchanged.
• Secret wiring (HF_DOC_BUILD_PUSH, COMMENT_BOT_APP_ID, COMMENT_BOT_SECRET_PEM) is unchanged by this PR.

Open RFCs Context

Open RFCs — In Review: 000 (project phases), 001 (abstractions), 002 (env spec), 003 (MCP support), 005 (agentic harnesses); Draft: 010 (ECHO world-model); 004 (rubrics) carries no status field — all concern the environment framework (abstractions, env spec, MCP, rubrics, harnesses, world-modeling). None cover CI or documentation-deploy workflow pinning, so there is no overlap with this change.

Tier 1: Fixes Required

• None. No code changes; the SHA pin is valid, immutable, and verified against upstream.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. This is CI/doc-deploy infrastructure; it does not touch the Gymnasium/MCP API surface, rewards-in-environment, client-server separation, or container isolation described in PRINCIPLES.md / INVARIANTS.md.

RFC Conflicts

None identified.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Low-risk, verified Dependabot bump. The only automated-check "failure" (lint) is pre-existing envs/ formatting drift on main, unrelated to this diff.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Supply-chain check: passed. Verified against upstream huggingface/doc-builder:

• 7ccf6c0 is identical to doc-builder@main HEAD, so the trailing # main comment is accurate.
• Real commit "fix(ci): read _versions.yml from the serving bucket (docs: correct StepResult field list in concepts guide #811)", authored by maintainer @XciD and merged via GitHub.
• Clean forward bump: 2 commits ahead of the old pin, 0 behind (no history rewrite).
• The old→new delta does not modify this reusable workflow file — only build_main_documentation.yml, src/doc_builder/utils.py, and tests/test_utils.py.
• Pinned to a full 40-char commit SHA (recommended practice).

[cursor]

Alignment Review Report

Scope: 1 file changed, +1/-1 — .github/workflows/upload_pr_documentation.yml. GitHub Actions SHA-pin bump (6108e85 → 7ccf6c0) for the reusable huggingface/doc-builder PR-docs upload workflow. No Python, framework, client/server, or environment code is touched.

Automated Checks

• Lint: N/A for this PR's scope — 0 Python files changed. .claude/hooks/lint.sh still exits non-zero, but only on pre-existing envs/* formatting drift (Python files + Python code blocks inside envs/*/README.md) that exists on main independent of this change; none are in this diff. No new lint surface.
• Debug code: CLEAN for this PR. .claude/hooks/check-debug.sh only surfaces pre-existing items in src/ (Rich console.print(...) in cli/commands/push.py, three pre-existing TODOs) — nothing in this diff.

Supply-chain verification (GitHub Actions bump)

• Pinned to a full 40-char commit SHA (immutable), not a mutable tag — recommended practice, preserved.
• 7ccf6c0 is a real commit — "fix(ci): read _versions.yml from the serving bucket (#811)", authored by maintainer @XciD, merged via GitHub.
• Clean fast-forward: the new SHA is 2 commits ahead of the old pin and 0 behind (no divergence / history rewrite).
• 7ccf6c0 is identical to doc-builder@main HEAD, so the trailing # main comment stays accurate.
• Caller contract unchanged: the old→new delta does not modify the upload_pr_documentation.yml reusable workflow itself (only build_main_documentation.yml, src/doc_builder/utils.py, tests/test_utils.py), so its workflow_call inputs/secrets are byte-identical. OpenEnv's caller still supplies the required package_name: openenv + hf_token (plus optional comment_bot_*) — it won't fail to start, and the cross-workflow doc-build-artifact contract is unaffected.
• Secret wiring (HF_DOC_BUILD_PUSH, COMMENT_BOT_APP_ID, COMMENT_BOT_SECRET_PEM) is unchanged and stays secrets.* references (no credential exposure).

Mergeability (stale-branch check)

Authoritative git merge-tree origin/main <head> = CLEAN (exit 0, single tree, no conflicts). The PR is a clean 1-commit fast-forward — its parent is the current main tip (024eedc9), 0 commits behind. No stale-branch merge conflict.

Open RFCs Context

Open RFCs — In Review: 000 (project phases), 001 (abstractions), 002 (env spec), 003 (MCP support), 005 (agentic harnesses); Draft: 010 (ECHO world-model); 004 (rubrics) has no status field — all concern the environment framework. None cover CI, GitHub Actions, or the docs-build pipeline, so there is no overlap with this change.

Tier 1: Fixes Required

• None. No code changes; the SHA pin is valid, immutable, and verified against upstream, and the branch merges cleanly.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. This is CI/doc-deploy infrastructure; it does not touch the Gymnasium/MCP API surface, rewards-in-environment, client-server separation, or container isolation in PRINCIPLES.md / INVARIANTS.md. Full-SHA pinning plus Dependabot freshness reinforces the reproducibility/security posture.

RFC Conflicts

None identified.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Low-risk, verified first-party (HF-owned) Dependabot bump.

Non-blocking FYI (sibling pins): OpenEnv pins huggingface/doc-builder reusable workflows in three files. This PR advances only upload_pr_documentation.yml to 7ccf6c0; build_pr_documentation.yml:13 and build_documentation.yml:12 (build_main) remain at 6108e85. This temporary skew is expected — Dependabot's github-actions updater treats each workflow path as a separate dependency and bumps them via separate PRs (or an aggregate codex/dependabot-core-* roll-up). No action needed here. cc @burtenshaw (CI/dependabot config owner).

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Supply-chain check: passed. Verified against upstream huggingface/doc-builder:

• 7ccf6c0 is identical to doc-builder@main HEAD, so the trailing # main comment is accurate.
• Real commit "fix(ci): read _versions.yml from the serving bucket (docs: correct StepResult field list in concepts guide #811)", authored by maintainer @XciD and merged via GitHub.
• Clean fast-forward: 2 commits ahead of the old pin, 0 behind (no history rewrite).
• Caller contract is safe: the old→new delta does not modify this reusable workflow file itself (only build_main_documentation.yml, src/doc_builder/utils.py, tests/test_utils.py), so its workflow_call inputs/secrets are byte-identical.
• Pinned to a full 40-char commit SHA (recommended practice).

[burtenshaw]

Closing in favor of aggregate non-env Dependabot PR #1069.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.