chore(deps): aggregate non-env dependabot updates - #1109
Conversation
…documentation.yml Bumps [huggingface/doc-builder/.github/workflows/build_pr_documentation.yml](https://github.com/huggingface/doc-builder) from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 1b16dac5e33043af565fdf4c1b5b0fe81d0891c8. - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md) - [Commits](huggingface/doc-builder@7ccf6c0...1b16dac) --- updated-dependencies: - dependency-name: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml dependency-version: 1b16dac5e33043af565fdf4c1b5b0fe81d0891c8 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…n_documentation.yml Bumps [huggingface/doc-builder/.github/workflows/build_main_documentation.yml](https://github.com/huggingface/doc-builder) from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 1b16dac5e33043af565fdf4c1b5b0fe81d0891c8. - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md) - [Commits](huggingface/doc-builder@7ccf6c0...1b16dac) --- updated-dependencies: - dependency-name: huggingface/doc-builder/.github/workflows/build_main_documentation.yml dependency-version: 1b16dac5e33043af565fdf4c1b5b0fe81d0891c8 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…_documentation.yml Bumps [huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml](https://github.com/huggingface/doc-builder) from 7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c to 1b16dac5e33043af565fdf4c1b5b0fe81d0891c8. - [Release notes](https://github.com/huggingface/doc-builder/releases) - [Changelog](https://github.com/huggingface/doc-builder/blob/main/RELEASE.md) - [Commits](huggingface/doc-builder@7ccf6c0...1b16dac) --- updated-dependencies: - dependency-name: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml dependency-version: 1b16dac5e33043af565fdf4c1b5b0fe81d0891c8 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
burtenshaw
added
Dependencies
github_actions
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
burtenshaw
added
enhancement
Cursor
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Aggregate github-actions dependabot roll-up: bumps the three huggingface/doc-builder reusable-workflow pins 7ccf6c02 → 1b16dac5 (doc-builder main HEAD, #816 Remove setup.py in favor of pyproject.toml). This is the codex aggregate of the three same-day sibling pin PRs (#1104 build_pr, #1105 build_main, #1106 upload); all three pins were uniform @7ccf6c02 on main, so this reconverges them in one commit.
Automated Checks
- Lint: PASS (N/A for PR scope) —
lint.shis a Python-only hook and this PR changes 0.pyfiles (3.ymlonly).uvisn't installed on the review VM, so the hook exits before ruff (tree stays clean). No lint surface. - Debug code: CLEAN —
check-debug.sh(scanssrc/only) reports only pre-existing CLIconsole.print/TODOs (build.py,serve.py,__main__.py,test_local_docker_provider.py); none touch the 3 changed workflow files.
Open RFCs Context
rfcs/ = 000/001/002/003/005/008 (In Review), 004 (Rubrics, no Status header), 010 (Draft). None cover CI / GitHub Actions / the docs-build pipeline / dependency management. RFC 008 (Environment Auto-Validation, In Review) governs src/openenv/validation/** + openenv validate, not CI → no conflict with a workflow SHA bump.
Tier 1: Fixes Required
None. Verified:
- New pin
1b16dac5is a full 40-char SHA == doc-buildermainHEAD (1b16dac5...main= identical;# maincomment accurate); clean fast-forward from7ccf6c02(ahead 12 / behind 0). - All 3 head workflows parse as valid YAML.
- Caller contract OK. The delta changes the
build_main+build_prreusable workflows (doc-builder #808 adds an optionalpython_versioninput — norequired:, nodefault:; theuv venvline is byte-identical when unset) and leavesupload_pr_documentation.ymlbyte-identical (not in the compare's changed files). Required inputs are unchanged — build_main:commit_sha/package+hf_token; build_pr:commit_sha/pr_number/package; upload:package_name+hf_token. OpenEnv's callers supply all required inputs and don't passpython_version→ won't break. - Artifact
doc-build-artifacthandoff unchanged; all secrets staysecrets.*references (no hardcoded credentials).
Tier 2: Alignment Discussion
Principle Conflicts: None. Full-SHA pinning + dependabot freshness reinforces the reproducibility/security principle (PRINCIPLES.md, @Darktex). hf_token remains a secrets.* reference → no credential-exposure invariant flag.
RFC Conflicts: None.
⚠️ Non-blocking FYI — branch is stale vs main (predates the RFC-008 revert)
This aggregate branch was cut from 3d9eac18 (RFC 008 slice 1, #1091). Since then main reverted the entire RFC-008 validation stack in b9d8c1f9 (#1108 Revert RFC 008 validation stack), so main no longer has src/openenv/validation/** — but this branch's snapshot still does.
- GitHub's Files changed (three-dot, from the merge-base) correctly shows only the 3 workflow files. A two-dot
main..headdiff looks huge (as if it re-adds ~40 validation files) — that is not what a merge does. - Verified safe:
git merge-tree main <head>is clean (no conflict), and diffing the resulting merge tree against currentmainyields exactly the 3 workflow files (3 insertions / 3 deletions), with 0 validation files resurrected. All three GitHub merge strategies (merge / squash / rebase) preserve main's revert. - Recommendation (optional, not a blocker): rebase onto current
mainso the PR diff is unambiguous and no reviewer is misled by the stale validation snapshot. cc @burtenshaw (dependabot-config / aggregate-roll-up owner).
Summary
- 0 mechanical issues (Tier 1)
- 0 principle alignment points (Tier 2)
- 0 RFC conflicts
- 1 non-blocking FYI: stale branch predating main's RFC-008 revert (#1108) — merge verified clean & non-resurrecting; optional rebase recommended for clarity. Sibling single-path PRs (#1104/#1105/#1106) become redundant once this lands.
Sent by Cursor Automation: Pre-review
| jobs: | ||
| build: | ||
| uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c # main | ||
| uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@1b16dac5e33043af565fdf4c1b5b0fe81d0891c8 # main |
There was a problem hiding this comment.
build_main pin 7ccf6c02 → 1b16dac5 (doc-builder main HEAD #816; clean fast-forward, ahead 12 / behind 0). This reusable workflow's definition did change in the delta via doc-builder #808 — it adds an optional python_version input (no required:, no default:; the uv venv step is byte-identical when it's unset). Required inputs are unchanged (commit_sha/package + secret hf_token), and this caller (L14-18) doesn't pass python_version → no break. Full 40-char SHA pin retained; hf_token stays a secrets.* ref.
| build: | ||
| if: github.event.pull_request.draft == false | ||
| uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c # main | ||
| uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@1b16dac5e33043af565fdf4c1b5b0fe81d0891c8 # main |
There was a problem hiding this comment.
build_pr pin 7ccf6c02 → 1b16dac5. Same doc-builder #808 change applies here: an optional python_version input is added (backward-compatible). Required inputs unchanged (commit_sha/pr_number/package; no secrets block); this caller doesn't pass python_version → no break, and it keeps the runner's system Python (identical behavior).
| jobs: | ||
| build: | ||
| uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c # main | ||
| uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@1b16dac5e33043af565fdf4c1b5b0fe81d0891c8 # main |
There was a problem hiding this comment.
upload pin 7ccf6c02 → 1b16dac5. The upload reusable workflow is byte-identical across this delta (it is not among the doc-builder compare's changed files) → its workflow_call inputs/secrets are trivially unchanged and the doc-build-artifact handoff is intact. Required package_name + hf_token are supplied by this caller (L13-17); all secrets remain secrets.* refs.
1 participant
Aggregates non-env Dependabot updates from #1104, #1105, and #1106.\n\nScope:\n- .github/workflows/build_pr_documentation.yml\n- .github/workflows/build_documentation.yml\n- .github/workflows/upload_pr_documentation.yml\n\nValidation:\n- git diff --check origin/main...HEAD\n- diff readback limited to .github/workflows files\n\nIndividual Dependabot PRs should be closed in favor of this aggregate after readback.