security: harden docs-builder, changelog, and workflow trust boundaries

[cotti]

Summary

Rebuilt on the current main to retain only the security remediations that are
still needed. The obsolete Vale SHA-pin changes and unrelated generated
workflow/compiler churn have been removed.

Issues addressed

Issue	Current fix
elastic/docs-eng-team#518 (consumer, part 1)	docs-deploy.yml and the docs-builder/setup edge path pull ghcr.io/elastic/docs-builder:edge, resolve it to an immutable RepoDigest, and use that digest for the rest of the job.
elastic/docs-eng-team#505	PR bodies are staged as mode-0600 files under RUNNER_TEMP, capped at 64 KiB without splitting UTF-8 code points. The validate path reads directly from GITHUB_EVENT_PATH; neither path transports the body through a step output or environment variable. Inline title metadata is bounded/sanitized and comma-containing label names fail closed.
elastic/docs-eng-team#497 (comment-rendering side)	Generated YAML uses a backtick fence longer than any run in the content. Paths, filenames, and labels use dynamically sized inline-code delimiters, preventing attacker-controlled backticks from escaping their Markdown context.
elastic/docs-eng-team#511	Fork trust gates now require the PR opener, workflow_run.actor, and (when present) workflow_run.triggering_actor all to be Elastic members. Commit authors/committers are intentionally excluded because they represent authorship rather than the account that pushed and triggered the run.

Resolved elsewhere / removed from this PR

• #498 and
  #509: removed. Vale was
  migrated into this repository by
  docs-actions#162, and the
  reusable workflows now call elastic/docs-actions/vale/{lint,report}@v1.
  Separately pinning an action inside the same repository would not add a useful
  trust boundary.

Dependencies and follow-ups

• Do not merge before
  elastic/docs-builder#3329.
  That PR adds the PR_BODY_FILE support consumed by the #505 remediation.
• Digest resolution is deliberately only consumer part 1 of #518. Provenance
  verification remains in
  docs-actions#160 and depends
  on docs-builder publishing an attested edge image.

Commits

• c55ade1 security: pin docs-builder edge image per run
• 41a6378 security: stage changelog PR bodies in files
• 07715f0 security: harden changelog PR comment rendering
• 87573c5 security: verify workflow-run actors for fork trust gates

Verification

• pre-commit run --all-files
• Existing Vale lint tests: 35 passed on Python 3.14
• Existing Vale report tests: 43 passed on Python 3.14
• Temporary, non-committed Node smoke checks for:
  • PR-body truncation, UTF-8 boundaries, file permissions, event-file staging,
    output omission, and comma-label rejection
  • hostile Markdown fences and inline backticks
  • member/non-member push actors, re-run actors, missing actor fail-closed,
    explicit-user compatibility, and absent-token fail-closed
• node --check for all modified/new JavaScript files
• git diff --check origin/main...HEAD

[theletterf]

The SHA pins for elastic/vale-rules/lint and elastic/vale-rules/report introduced in this PR are no longer needed.

Since this PR landed, both actions were moved in-house into this repo:

• .github/workflows/docs-build.yml now uses elastic/docs-actions/vale/lint@v1
• .github/workflows/docs-deploy.yml now uses elastic/docs-actions/vale/report@v1

The original security concern was a floating @main tag on an external repo (elastic/vale-rules) holding pull-requests: write — a genuine supply-chain risk. That risk is gone: the workflows now reference actions within elastic/docs-actions itself, so there is no external dependency to pin.

Suggest removing the SHA pins from this PR (or following up with a cleanup PR if it has already landed) to reduce maintenance overhead.

Issues were solved since.