chore: point openspiel base image to ghcr.io/huggingface namespace

[sergiopaniego]

Summary

Point the OpenSpiel environment at the canonical ghcr.io/huggingface/openenv-openspiel-base base image instead of the legacy ghcr.io/meta-pytorch namespace. The base image is now built and published to the huggingface namespace by openspiel_base_build.yml, so the env Dockerfile default and the docs should reference it there. The Dockerfile now tracks :latest rather than a pinned (and stale) sha- tag.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• New environment
• Refactoring

Alignment Checklist

Before submitting, verify:

• I have read .claude/docs/PRINCIPLES.md and this PR aligns with our principles
• I have checked .claude/docs/INVARIANTS.md and no invariants are violated
• I have run /pre-submit-pr (or bash .claude/hooks/lint.sh and tests) and addressed all issues

RFC Status

• Not required (bug fix, docs, minor refactoring)
• RFC exists: #___
• RFC needed (will create before merge)

Test Plan

• python scripts/sync_env_docs.py --check passes (the openspiel.md stub was regenerated from the README with --fix).
• ghcr.io/huggingface/openenv-openspiel-base is public and pullable (verified anonymously).
• Building the env consumes the new base image:

docker build -t openspiel-env:latest -f envs/openspiel_env/server/Dockerfile envs/openspiel_env
This requires the base image build (openspiel_base_build.yml) to have published :latest to the huggingface namespace from main first.

Claude Code Review

N/A

---

Note

Low Risk
Docs and Docker defaults only; no application logic changes. Using :latest instead of a pinned digest is a minor reproducibility tradeoff for builds.

Overview
Switches the OpenSpiel env’s default pre-built Docker base from ghcr.io/meta-pytorch/openenv-openspiel-base:sha-e622c7e to ghcr.io/huggingface/openenv-openspiel-base:latest, matching where openspiel_base_build.yml now publishes the image.

The same registry path is updated in server/Dockerfile, server/prepare_hf.sh (HF Space Dockerfile rewrite), and the build docs in envs/openspiel_env/README.md / docs/source/environments/openspiel.md.

^{Reviewed by Cursor Bugbot for commit 4da704e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[sergiopaniego]

Creation of image running in: https://github.com/huggingface/OpenEnv/actions/runs/28428789353
It was already created from the previous PR: https://github.com/huggingface/OpenEnv/actions/runs/28372407486 and worked (https://github.com/huggingface/OpenEnv/pkgs/container/openenv-openspiel-base)

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b35b83f. Configure here.}

[cursor]

Alignment Review Report

Automated Checks

• Lint: N/A for this diff — lint.sh could not run in the review sandbox (uv not installed), but the PR only changes 2 Markdown files + 1 Dockerfile (no Python under src//tests/), so the lint scope is unaffected.
• Debug code: CLEAN — check-debug.sh only reported pre-existing print/TODO lines in src/; none are in the files this PR touches.

Open RFCs Context

RFCs 000–003 and 005 are In Review, 010 is Draft — covering abstractions, env spec, MCP, agentic harnesses, and world-modeling. None touch container base-image namespaces or registry references, so this chore PR does not intersect any open RFC.

Tier 1: Fixes Required

• envs/openspiel_env/server/Dockerfile:26 — The new default ARG OPENSPIEL_BASE_IMAGE=ghcr.io/huggingface/openenv-openspiel-base:latest points at a tag that does not exist. The huggingface/openenv-openspiel-base package currently has only sha-7a9bb94 (verified against GHCR — no latest tag), so docker build -f server/Dockerfile . will fail with manifest unknown. Unlike openenv-base (rebuilt and re-tagged latest on every push to main via docker-build.yml), the OpenSpiel base is built by openspiel_base_build.yml, which is workflow_dispatch-only — so :latest is not auto-maintained. Fix: pin to the tag that exists → ghcr.io/huggingface/openenv-openspiel-base:sha-7a9bb94, or run Build OpenSpiel Base Image on main to publish latest before merging.
• envs/openspiel_env/server/prepare_hf.sh:24 — Still hardcodes the old namespace + tag ghcr.io/meta-pytorch/openenv-openspiel-base:sha-e622c7e. This is the script scripts/prepare_hf_deployment.sh invokes to rewrite the Dockerfile for HF Spaces deployments, so the PR's stated goal ("point openspiel base image to ghcr.io/huggingface namespace") is not achieved for deployments until this line is updated. (This file is not in the diff, so flagging it here rather than inline.) Fix: ghcr.io/huggingface/openenv-openspiel-base:sha-7a9bb94.

Both fixes converge cleanly: using ghcr.io/huggingface/openenv-openspiel-base:sha-7a9bb94 in both files completes the namespace migration, keeps the build working (that tag exists today), and preserves the reproducible pin the env had before.

Tier 2: Alignment Discussion

Principle Conflicts

ALIGNMENT FLAG: Base image moves from a pinned SHA to a floating :latest tag

• Principle at stake: "Container isolation for reproducibility" / "Docker overhead is acceptable for reproducibility" (PRINCIPLES.md)
• The concern: The env previously pinned :sha-e622c7e; switching the default to :latest trades build reproducibility for a mutable tag. There is a consistency argument (other envs use openenv-base:latest), but that base is auto-rebuilt on main, whereas the OpenSpiel base is manual-only, so :latest is prone to drift or absence (it is missing right now). Pinning to sha-7a9bb94 keeps the prior reproducibility posture and fixes the broken build at the same time — worth a deliberate call on which convention to adopt for the OpenSpiel base.
• Suggested reviewer: @Darktex (authored the reproducibility trade-off line in PRINCIPLES.md); @burtenshaw (authored prepare_hf.sh:24 and owns the base-image / HF deploy workflows)

RFC Conflicts

None identified.

Summary

• 2 mechanical issues to fix (non-existent :latest base tag → broken build; stale meta-pytorch reference in the HF deploy script)
• 1 alignment point for human review (floating :latest vs pinned SHA → reproducibility)
• 0 RFC conflicts

  

_{Sent by Cursor Automation: Untitled}

[cursor]

Tier 1 — this tag does not exist yet. ghcr.io/huggingface/openenv-openspiel-base currently publishes only sha-7a9bb94 (no latest), so building this Dockerfile fails with manifest unknown. The OpenSpiel base is produced by openspiel_base_build.yml, which is manual (workflow_dispatch) only — so :latest is not auto-maintained the way openenv-base:latest is (that one is rebuilt on every push to main).

Suggested fix (also preserves the env's previous reproducible pin):

ARG OPENSPIEL_BASE_IMAGE=ghcr.io/huggingface/openenv-openspiel-base:sha-7a9bb94

…or run Build OpenSpiel Base Image on main first to publish latest.

Related: envs/openspiel_env/server/prepare_hf.sh:24 still hardcodes ghcr.io/meta-pytorch/openenv-openspiel-base:sha-e622c7e and needs the same namespace update so HF Spaces deploys also move off meta-pytorch.

[sergiopaniego]

updated

[sergiopaniego]

it worked! https://github.com/huggingface/OpenEnv/pkgs/container/openenv-openspiel-base