Pass shared build config via artifact to eliminate duplicate inputs

[reakaleek]

Summary

Consumer repos must currently specify the same 5 inputs (strict, continue-on-error, path-pattern, path-pattern-ignore, enable-vale-linting) in both their docs-build.yml and docs-deploy.yml caller workflows. For example, docs-content and docs-eng-playground both duplicate enable-vale-linting: true and path-pattern: 'docs/**' across both files. This creates maintenance burden and drift risk when the values diverge between the two callers.

How it works

1. docs-build.yml — new export-config job serializes the 5 shared input values into a versioned JSON artifact (docs-build-config) using jq --arg
2. docs-deploy.yml — downloads the artifact from the triggering workflow_run, validates it, and uses the values via preflight job outputs (cfg-strict, cfg-continue-on-error, etc.)
3. The 5 shared inputs are removed from docs-deploy.yml's workflow_call interface — only disable-comments and enable-cumulative-comment remain
4. If no artifact is found (e.g. older build workflow version), hardcoded defaults are emitted matching the previous input defaults

Security hardening

The artifact is parsed defensively since it originates from a different workflow run:

• No shell interpolation: JSON produced with jq --arg, parsed exclusively with jq
• Schema validation: version field, type checks on every field
• Value allowlisting: strict and continue-on-error must be exactly "true" or "false"
• Character denylisting: path patterns reject shell metacharacters (;|&$\(){}\`)
• Artifact pinning: downloaded with explicit run-id: ${{ github.event.workflow_run.id }}
• Heredoc output: path values written to $GITHUB_OUTPUT using heredoc delimiters to prevent multi-line corruption

Breaking change

Consumer repos that pass the 5 removed inputs to docs-deploy.yml will get a workflow validation error and must remove them from their deploy caller workflow. After this change, a consumer's docs-deploy.yml simplifies from:

# Before
jobs:
  deploy:
    uses: elastic/docs-actions/.github/workflows/docs-deploy.yml@v1
    with:
      path-pattern: 'docs/**'
      enable-vale-linting: true

to:

# After
jobs:
  deploy:
    uses: elastic/docs-actions/.github/workflows/docs-deploy.yml@v1

The shared config values are now automatically inherited from whatever was passed to docs-build.yml.

Test plan

• Point a consumer repo (e.g. docs-eng-playground) at this branch for both workflows
• Verify docs-build-config artifact is uploaded by the build workflow
• Verify docs-deploy downloads and parses the artifact (check "Parse and validate config" step logs)
• Verify build + deploy succeed with artifact-sourced values
• Verify backward compat: temporarily remove artifact upload to confirm deploy falls back to defaults
• Verify invalid JSON / bad schema in artifact causes a hard failure (not silent fallback)

🤖 Generated with Claude Code