chore(deps): bump huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to af49b8dc3859c3d80c7220c8c0ba146431132e49

[dependabot]

Bumps huggingface/doc-builder/.github/workflows/build_pr_documentation.yml from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to af49b8dc3859c3d80c7220c8c0ba146431132e49.

Commits

• af49b8d Declare ruff as a runtime dependency (#815)
• ffa5997 Add ruff to the list of dependencies (#785)
• 6dd1bda Preserve Markdown callout blockquote lines in docbuilder style docstring fo...
• 931031b Add python_version input to doc build workflows (#808)
• 9a49534 fix(kit): escape curly braces in markdown link & image URLs (#812)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Single CI workflow SHA bump for PR docs only; no application or runtime code changes.

Overview
Updates the reusable PR documentation workflow in .github/workflows/build_pr_documentation.yml to pin huggingface/doc-builder at commit af49b8d instead of 7ccf6c0.

PR doc builds for openenv will run against the newer upstream workflow (e.g. added ruff as a runtime dependency, optional python_version input, and docstring/markdown handling fixes in that range). Inputs are unchanged: commit_sha, pr_number, package, and version_tag_suffix.

^{Reviewed by Cursor Bugbot for commit 5f5145a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Single-line dependabot bump of the pinned huggingface/doc-builder reusable build_pr_documentation.yml SHA: 7ccf6c02 → af49b8dc (.github/workflows/build_pr_documentation.yml:13).

Automated Checks

• Lint (.claude/hooks/lint.sh): N/A for this PR's scope — 0 Python files changed (diff is one line of workflow YAML). The Python-only hook still exit-1's on ~25 pre-existing unformatted envs/** files (chat_env, opencode_env, pi_env, …) that this PR does not touch — not introduced here. (Running it also reformats python code-fences in ~30 README.md files as a side effect; reverted, unrelated to this PR.)
• Debug code (.claude/hooks/check-debug.sh): CLEAN for changed files. All hits are pre-existing src/ CLI console.print, docstring examples, and TODOs — none in this diff.

Open RFCs Context

Open RFCs on main: 000/001/002/003/004/005 (In Review), 010 (Draft). All govern the runtime environment API (Gym-like reset/step/state, MCP, rewards-in-env, client-server separation, Pydantic wire types). None cover CI, GitHub Actions, dependency management, or the docs-build pipeline — so this workflow-pin bump has no RFC surface.

Verification (read-only via gh api)

• SHA legit + current: af49b8dc = doc-builder #815 "Declare ruff as a runtime dependency" (2026-08-19). 7ccf6c02...af49b8dc = ahead 5 / behind 0 (clean fast-forward); af49b8dc...main == identical → it is the current doc-builder main HEAD, so the trailing # main comment stays accurate.
• Caller contract (where a break would hide): the delta does modify build_pr_documentation.yml (doc-builder #808), but only backward-compatibly — it ADDS an optional input python_version (type: string, no required, no default) and rewrites uv venv → uv venv ${{ inputs.python_version && format('--python {0}', …) || '' }} (byte-identical when unset). At af49b8dc the workflow_call required inputs are still exactly commit_sha / pr_number / package, and this caller supplies all three (+ version_tag_suffix: "", no secrets) → no new required input, won't fail to start; OpenEnv keeps the runner's system Python (unchanged behavior).
• Security: still pinned to a full 40-char SHA (not a tag/branch) → supply-chain pinning maintained; no secrets on this workflow.
• Mergeability: git merge-tree vs current origin/main (018b90bc, == PR base) = CLEAN (single tree, no conflict) → clean 1-commit fast-forward. YAML parses.

Tier 1: Fixes Required

None.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. Full-SHA pinning + dependabot freshness aligns with the reproducibility/security posture in PRINCIPLES.md; no runtime API / reward / client-server / MCP / Pydantic surface is touched.

RFC Conflicts

None identified (no open RFC covers CI / GitHub Actions / doc-build).

Notes (non-blocking)

• Coordinated trio: dependabot opened three sibling PRs to the same af49b8dc — #1088 (upload_pr_documentation.yml), #1089 (build_documentation.yml / build_main), and this #1090 (build_pr_documentation.yml). Each reusable-workflow path is tracked separately, so merging only one leaves a temporary SHA skew (the other two stay @7ccf6c02 on main). Expected and informational; reconverges once all three (or a codex aggregate) land — merging them together keeps the three pins in sync.
• This PR supersedes the earlier unmerged build_pr bumps #1076 (→931031bf) and #1083 (→6dd1bdab), both now CLOSED — dependabot recreated it at the newer main HEAD.

Summary

• 0 mechanical issues to fix (Tier 1)
• 0 alignment points for human review (Tier 2)
• 0 RFC conflicts

Clean, low-risk doc-builder pin bump to the current main HEAD; interface-compatible and merges cleanly.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Verified: af49b8dc is the current huggingface/doc-builder main HEAD (doc-builder #815, 2026-08-19). 7ccf6c02...af49b8dc is a clean fast-forward (ahead 5 / behind 0) and af49b8dc...main is identical, so the # main pin comment stays accurate, and the full 40-char SHA pin is retained.

The only change to this reusable workflow across the bump is doc-builder #808, which adds an optional python_version input and a uv venv line that is byte-identical when the input is unset. The workflow_call required inputs at af49b8dc are still exactly commit_sha / pr_number / package — all supplied by this caller (lines 15-17) — so nothing breaks.

[dependabot]

Superseded by #1104.