ci(autodoc): fix Bedrock OIDC and harden autodoc workflow

[jdcmsd]

Summary

The autodoc workflow (issue_autodoc.yml) was failing at AssumeRoleWithWebIdentity in production with a Not authorized to perform sts:AssumeRoleWithWebIdentity error that never appeared on core-workflow-test. Root cause: the IAM trust policy on GitHubActions-BedrockCodeReview gates on the OIDC job_workflow_ref claim, which only resolves correctly when the job is invoked via a reusable workflow — not when it runs inline.

Changes

• Restructure workflow into a multi-job pipeline: preflight → prep → claude → finalize. The claude job calls dotCMS/ai-workflows/.github/workflows/autodoc-executor.yml as a reusable workflow, ensuring the job_workflow_ref OIDC claim resolves to dotCMS/ai-workflows/...@refs/tags/* and satisfies the Bedrock role trust condition.
• modUser guardrail: skip applying a draft when a human (not the CI Autodoc service account) has an outstanding working draft on the content, to avoid overwriting human edits.
• Pin action SHAs to address Semgrep supply-chain findings.
• Replace secrets: inherit with explicit secret map for least-privilege.
• Move AUTODOC_DOTCMS_SITE_FOLDER and AUTODOC_DOTCMS_BASE_URL from Secrets to Variables — neither is a credential; treating them as secrets obscures config unnecessarily.

Related

• dotCMS/ai-workflows#65 (merged) — introduces autodoc-executor.yml reusable workflow
• Bedrock IAM role: GitHubActions-BedrockCodeReview

[github-actions]

PRs linked to this issue

• ci(autodoc): route Claude execution through ai-workflows to fix Bedrock OIDC by @jdcmsd
• fix(autodoc): trailing newline + random delimiter in eval context output by @jdcmsd

[jdcmsd]

Needs a little more work. Execution failed; Claude thinks there was a trailing newline missing.

The bug is a missing trailing newline in the eval context file.

The Python script writes /tmp/eval_context.md as '\n'.join(lines) with no trailing \n. The last character of the file is therefore '.' (end of "Use the Write tool to write the report to exactly that path."). When cat /tmp/eval_context.md runs, stdout has no trailing newline, so echo 'AUTODOC_EOF' appends directly to that last line. In GITHUB_OUTPUT the file ends up looking like:

...Use the Write tool to write the report to exactly that path.AUTODOC_EOF

The runner looks for AUTODOC_EOF as a standalone line and never finds it. Every run of this new multi-job structure would fail for the same reason — this is almost certainly the first real trigger of the prep → claude path since the OIDC restructure.

Two fixes: add the trailing newline, and switch to a random delimiter as defense-in-depth (so no future issue body can accidentally inject the delimiter).

Adding separate PR.