fix(ci): re-pin publish-single-page-docs to a working upstream SHA

[oto-macenauer-absa]

Overview

The Publish Docs workflow added in #93 cannot run. It pins
AbsaOSS/knowledge-base/actions/publish-single-page-docs at
679ec075cab1e1cdfb1140eedad7f2f80a5b683a, and the action manifest at that
commit is invalid YAML — the github-token description holds an unquoted
: (colon-space) inside backticks, which YAML reads as a nested mapping:

  github-token:
    description: Token used to upload the release asset. Needs `contents: write`.

The runner therefore fails while loading the manifest, before any step runs.
This already happened in production: run 30910992670 on master
(workflow_dispatch) failed with

(Line: 26, Col: 73, Idx: 944): Mapping values are not allowed in this context.
System.ArgumentException: Unexpected type '' encountered while reading 'action manifest root'.
Failed to load AbsaOSS/knowledge-base/.../action.yml

Upstream fixed the manifest in fa935dc6ed1aae54d295e457424ee636914147c3
(fix: quote colon-containing description in publish-single-page-docs action manifest (#40)), which also added action-manifest validation to the
knowledge-base CI so the class of bug should not recur there. This PR bumps
the pin to that commit.

A second point worth recording: the review discussion on #93 assumed the
github-actions Dependabot group would keep this pin fresh. It will not.
Dependabot resolves a pinned action SHA forward to the SHA of the newest
release or tag, and AbsaOSS/knowledge-base currently publishes 0 tags and
0 releases — there is nothing to resolve to, so the pin would have sat on
the broken commit indefinitely. Pinning is still correct and stays; the
workflow now carries a two-line comment saying the bump is manual, so the
next reader does not inherit the same assumption.

Verification performed before pushing:

• action.yml at fa935dc fetched over the API (HTTP 200, so the action path
  exists at that SHA) and yaml.safe_load parses it cleanly; inputs are
  docs, github-token, release-tag as expected.
• .github/workflows/publish_docs.yml parses, and every uses: in it
  resolves to a bare 40-hex SHA ref.
• The docs: entry is byte-identical to feat(docs): publish documentation to the AbsaOSS knowledge base #93 — slug org-workflows-security,
  icon shield, tags [security, automation, aquasec, workflows], and the
  release-tag expression untouched.
• The action's renderer was run locally against this repository (the renderer
  src/ is unchanged between the local clone and fa935dc; the only diff is
  action.yml plus the new CI job). It rendered
  docs/security/security.md → org-workflows-security with Mermaid support
  and packed a 753 KB bundle successfully. Output was written to a scratch
  directory, not into the repo.

Only the pinned SHA and the new comment change; nothing else in the workflow
was touched.

Release Notes

• Fixed the Publish Docs workflow, which failed to start because the pinned
  publish-single-page-docs action revision contained an unparsable action
  manifest.
• Re-pinned AbsaOSS/knowledge-base/actions/publish-single-page-docs to
  fa935dc6ed1aae54d295e457424ee636914147c3, the upstream commit that fixes
  the manifest.
• Documented in the workflow that this pin is bumped manually, because the
  upstream repository publishes no tags or releases and Dependabot cannot
  track it.

Related

Closes #94

Summary by CodeRabbit

• Chores
  • Updated the documentation publishing workflow to use a newer pinned action version.
  • Added maintenance guidance for keeping the action reference current.

[coderabbitai]

Walkthrough

This PR updates the pinned commit reference for the publish-single-page-docs action in publish_docs.yml. It adds comments that explain the pin is manually maintained because the upstream repository has no tags or releases.

Changes

Action Pin Update

Layer / File(s)	Summary
Update pinned action commit .github/workflows/publish_docs.yml	The pinned commit for the publish-single-page-docs action is changed. Comments state that Dependabot cannot track this pin because it is manually maintained.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• Publish Docs workflow fails: pinned knowledge-base action manifest has a YAML syntax error #94: This issue reports a broken manifest for the pinned action. This PR re-pins the action commit in the same file.

Possibly related PRs

• AbsaOSS/organizational-workflows#93: This PR created the pinned commit reference in the same workflow file that this PR updates.

Suggested reviewers: miroslavpojer, tmikula-dev

Poem

A tiny hop, a pinned commit true,
No tags upstream, so we note it for you.
One line changed, comments in place,
The docs workflow keeps its steady pace. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description includes complete Overview, Release Notes, and Related sections with detailed problem, solution, verification, and issue information.
Title check	✅ Passed	The title clearly and concisely describes the main change: replacing the broken documentation action pin with a working upstream SHA.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bugfix/publish-docs-action-pin

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}