feat(actions): check-docs, the contract checks on a docs repo's pull request

[oto-macenauer-absa]

Adds a third composite action, actions/check-docs. It runs the knowledge base contract checks on a docs repo's pull request.

It uses the same checker publish-docs runs at release time (actions/lib/check.js, rules in contract/RULES.md), on the repo's manifest and built headless output. It never packs or uploads anything. A finding that would fail the publish now fails the pull request instead, one release earlier.

# .github/workflows/check-docs.yml in a docs repo
on:
  pull_request:
permissions:
  contents: read
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build -- --headless
      - uses: AbsaOSS/knowledge-base/actions/check-docs@v1
        with:
          manifest: kb-docs.json
          dist: dist

Behaviour

• Errors fail the check. These are what publish-docs refuses to release. Warnings fail it only with strict: true.
• One annotation per rule, with a count and the first example (KB-HTML-004 ×2, e.g. demo/…). A docs template repeats one finding on every page, and GitHub shows only the first few annotations of a step.
• The job summary tables every rule and lists every finding in a collapsible section.
• Paths go in as the repo wrote them, so findings name kb-docs.json and dist/…, not runner paths.
• Inputs: manifest, dist, strict, and the four private-registry inputs the other actions have. Outputs: errors, warnings.
• Packaged sites only. A publish-single-page-docs repo has no built output of its own to check.

Supporting changes

• Shared code. The CLI's manifest/output resolution becomes checkWorkspace() and the build's by-rule grouping becomes summarise(), both in check.js. The CLI, this action and the knowledge base build all use them.
• runner.js. annotate() can now emit titled warnings as well as errors.
• tests/private-registry.spec.js now discovers every actions/*/action.yml instead of listing two, so a new action cannot ship without the private-network inputs.
• CI runs ./actions/check-docs itself, with strict: 'true', on the clean single-page fixture. It asserts 0 errors and 0 warnings, so the composite is exercised on a real runner and not only through its entry point.
• The kb-docs-add audit report offers the PR check, and writes that workflow only if the user asks. This keeps the skill's "minimum files" rule.
• Docs: actions/check-docs/README.md, contract/RULES.md → "Running the checks", the main README and CLAUDE.md.

Testing

• npm run selftest in actions/ passes, including the new check-docs self-test. Its 7 cases:
  • a clean site;
  • warnings passing with one annotation per rule;
  • the summary table and the full finding list;
  • strict failing on warnings;
  • an error failing with its rule;
  • a missing manifest reported as KB-MAN-001;
  • custom manifest/dist paths.
• npm test: 386 of 386 passed.

After merge

Docs repos get check-docs@v1 only once a v1.2.0 tag moves v1.

Refs #67. Inline handlers (KB-HTML-005) are now reported on the docs repo's own pull request, where they can be fixed at the source.

🤖 Generated with Claude Code