feat(autodoc): add autodoc-executor reusable workflow by jdcmsd · Pull Request #65 · dotCMS/ai-workflows

jdcmsd · 2026-07-31T15:44:44Z

Summary

Adds autodoc-executor.yml, a purpose-built reusable workflow for the dotCMS documentation audit pipeline (issue_autodoc.yml in dotCMS/core)
Exposes AUTODOC_* secrets as env vars so Claude can call the dotCMS AI search and workflow APIs during execution
Uploads the generated report (/tmp/autodoc-report.md) as an artifact for the calling workflow's finalize job to consume
Kept separate from claude-executor.yml to avoid adding autodoc-specific secrets and artifact upload to the general-purpose code-review path

Why a new executor instead of extending `claude-executor`

claude-executor.yml is general-purpose (code review). Autodoc needs two things it doesn't: (1) pass-through of AUTODOC_* secrets as env vars to Claude, and (2) upload of the written report as an artifact. Grafting those onto claude-executor would pollute it with pipeline-specific concerns.

Dependency

dotCMS/core issue_autodoc.yml will reference this at @v3.5.0 — please tag after merge.

Test plan

Merge this PR and create tag v3.5.0
Merge the corresponding dotCMS/core PR (references autodoc-executor.yml@v3.5.0)
Close a test Epic in dotCMS/core and confirm the Actions run completes: OIDC assumption succeeds, Claude writes report, artifact is uploaded, finalize posts comment

🤖 Generated with Claude Code

…audit pipeline Adds a purpose-built reusable workflow that runs Claude Code via AWS Bedrock for the issue_autodoc.yml pipeline in dotCMS/core. Separating this from the general-purpose claude-executor keeps AUTODOC_* secret passthrough and the report artifact upload out of the code-review path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-07-31T15:45:16Z

🤖 Bedrock Review — `qwen.qwen3-next-80b-a3b`

New Issues

🟡 Medium: .github/workflows/autodoc-executor.yml:89 — AUTODOC_DOTCMS_SITE_FOLDER is passed via secrets but declared as optional in inputs; if unset, the secret will be empty string, not undefined — may cause unintended behavior if downstream expects null/absent.

Existing

🟡 Medium: .github/workflows/autodoc-executor.yml:89 — AUTODOC_DOTCMS_SITE_FOLDER is passed via secrets but declared as optional in inputs; if unset, the secret will be empty string, not undefined — may cause unintended behavior if downstream expects null/absent.

Resolved

✅ .github/workflows/autodoc-executor.yml:89 — Prior finding reconfirmed; no change made to fix it.

_{Run: #30661048595 · tokens: in: 2230 · out: 251 · total: 2481}

…to input - Pin actions/checkout, configure-aws-credentials, claude-code-action, and upload-artifact to full commit SHAs (Semgrep supply-chain findings) - Move AUTODOC_DOTCMS_SITE_FOLDER from secrets to a plain string input — it is non-sensitive config, not a credential, and is easier to trace as a var Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-08-03T19:20:57Z

🤖 Bedrock Review — `qwen.qwen3-next-80b-a3b`

Existing

🟡 Medium: .github/workflows/autodoc-executor.yml:89 — AUTODOC_DOTCMS_SITE_FOLDER is passed via secrets but declared as optional in inputs; if unset, the secret will be empty string, not undefined — may cause unintended behavior if downstream expects null/absent.

_{Run: #30845350176 · tokens: in: 2406 · out: 147 · total: 2553}

sfreudenthaler

getting closer. a few questions about unhappy path and one requested change for the base url

…y defaults AUTODOC_DOTCMS_BASE_URL is not a credential — it is config. Move it from secrets to a required string input (autodoc_dotcms_base_url) so it appears in Actions logs and is easy to verify without special access. Also clarify the intent of the two optional inputs that default to empty string: - model_id: empty → --model omitted → action uses its built-in default model - autodoc_dotcms_site_folder: empty → navFolder not set → content lands on SYSTEM_HOST Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-08-04T15:03:53Z

🤖 Bedrock Review — `qwen.qwen3-next-80b-a3b`

Existing

🟡 Medium: .github/workflows/autodoc-executor.yml:89 — AUTODOC_DOTCMS_SITE_FOLDER is passed via secrets but declared as optional in inputs; if unset, the secret will be empty string, not undefined — may cause unintended behavior if downstream expects null/absent.

_{Run: #30922170992 · tokens: in: 2461 · out: 147 · total: 2608}

All the conversations are marked as resolved, seems time to press forward.

sfreudenthaler

changes look good. let'r rip

jdcmsd requested review from a team as code owners July 31, 2026 15:44

semgrep-dotcms Bot reviewed Jul 31, 2026

View reviewed changes