chore(deps): bump huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 931031bf2b54aabb134ceb54980a6a2860a00f11

[dependabot]

Bumps huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 931031bf2b54aabb134ceb54980a6a2860a00f11.

Commits

• 931031b Add python_version input to doc build workflows (#808)
• 9a49534 fix(kit): escape curly braces in markdown link & image URLs (#812)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
CI-only dependency pin for documentation builds; no application runtime or security-sensitive code changes.

Overview
Updates the reusable Build PR Documentation workflow pin in .github/workflows/build_pr_documentation.yml from 7ccf6c0 to 931031b on huggingface/doc-builder.

Call-site with inputs (commit_sha, pr_number, package, version_tag_suffix) are unchanged; PR doc builds will use the newer upstream workflow (including its new optional python_version input and related doc-builder fixes).

^{Reviewed by Cursor Bugbot for commit 2e3c940. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Dependabot bump of the SHA-pinned huggingface/doc-builder reusable workflow build_pr_documentation.yml (7ccf6c02 -> 931031bf). Single-line change to .github/workflows/build_pr_documentation.yml; no Python or lockfile touched.

Automated Checks

• Lint: PASS (for this PR's scope) — the diff changes 0 Python files. The repo lint.sh hook exit-1's only on ~25 pre-existing envs/**/*.py formatting issues that are unrelated to this PR. (Tooling note: ruff 0.16.2 also reformats Python code fences inside ~30 README.md files when the hook runs over envs/; those edits were reverted and are not part of this PR.)
• Debug code: CLEAN — check-debug.sh surfaces only pre-existing src/ prints/TODOs; none appear in this PR's diff.

Open RFCs Context

All current RFCs are In Review (000, 001, 002, 003, 004, 005) except 010 (Draft). None cover CI, GitHub Actions, dependency management, or the documentation-build pipeline, so none are implicated by this change.

Tier 1: Fixes Required

None.

Supply-chain verification (reusable-workflow SHA bump)

• New SHA is a real commit — doc-builder #808 "Add python_version input to doc build workflows".
• Clean forward bump: 7ccf6c02...931031bf = ahead 2 / behind 0.
• 931031bf...main = identical, so the new SHA is doc-builder's current main HEAD and the trailing # main annotation stays accurate.
• Full 40-char SHA pin retained (no floating tag/branch).
• Caller contract is backward-compatible. The reusable workflow's own definition changed, but only to (1) ADD an optional python_version input (no required: true, no default) and (2) change uv venv -> uv venv ${{ inputs.python_version && format('--python {0}', inputs.python_version) || '' }}, which is byte-identical when the input is unset. OpenEnv's caller passes commit_sha / pr_number / package: openenv / version_tag_suffix: "" and does not pass python_version, so behavior is unchanged. No inputs removed, no secrets changed, and the doc-build-artifact upload step is untouched.
• Merge check: git merge-tree against current origin/main (5359534c) is conflict-free; the PR is a clean 1-commit fast-forward.
• Informational sibling skew: dependabot tracks each reusable-workflow path separately, so upload_pr_documentation.yml:11 and build_documentation.yml:12 (build_main) still pin 7ccf6c02 until their own bumps land. Expected, not a bug. (The github-actions updater is in-scope in dependabot.yml — the envs/** exclude-paths applies only to the uv updater.)

Tier 2: Alignment Discussion

Principle Conflicts

None identified. CI/doc-build config only — no runtime API, reward computation, client-server boundary, MCP, container, or credential surface is touched. Secrets remain secrets.* references (this workflow passes none). Full-SHA pinning + dependabot freshness aligns with the reproducibility/security posture.

RFC Conflicts

None identified. No RFC governs CI, GitHub Actions, or dependency management.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Clean, low-risk, backward-compatible dependabot GitHub Actions bump. No changes requested.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Verified this bump:

• 931031bf is doc-builder's current main HEAD (931031bf...main = identical), so the # main annotation stays accurate; clean forward bump from 7ccf6c02 (ahead 2 / behind 0), full 40-char SHA pin retained.
• The reusable workflow's interface change is backward-compatible — it only adds an optional python_version input (no default, not required) and switches uv venv to conditionally append --python when that input is set. OpenEnv's caller below doesn't pass python_version, so uv venv behavior is unchanged.
• Required inputs (commit_sha, pr_number, package), the passed version_tag_suffix: "", and the doc-build-artifact contract are all unaffected.

[dependabot]

Superseded by #1083.