changelog: Add prs-artifact input for PR-list bundle filtering

.github/workflows/changelog-bundle.yml

@@ -18,7 +18,8 @@ on:
       profile:
         description: >
           Bundle profile name from bundle.profiles in changelog.yml.
-          Mutually exclusive with release-version and prs.
+          Mutually exclusive with release-version and prs. A report or
+          prs-artifact may supply the filter source.
         type: string
       version:
         description: >
@@ -39,8 +40,18 @@ on:
         type: string
       prs:
         description: >
-          Comma-separated PR URLs or numbers, or a path to a newline-delimited file.
-          Mutually exclusive with profile, release-version, and report.
+          Comma-separated PR URLs or numbers, or a path to a newline-delimited
+          file committed to the repository. Mutually exclusive with profile,
+          release-version, report, and prs-artifact.
+        type: string
+      prs-artifact:
+        description: >
+          Name of a workflow artifact, uploaded earlier in the same run,
+          containing a single newline-delimited file of fully-qualified GitHub
+          PR or issue URLs (one kind per file, no mixing) to use as the bundle
+          filter source. Works in both profile mode (version is then required)
+          and option mode. Mutually exclusive with prs, report, and
+          release-version.
         type: string
       output:
         description: >
@@ -94,6 +105,7 @@ jobs:
           release-version: ${{ inputs.release-version }}
           report: ${{ inputs.report }}
           prs: ${{ inputs.prs }}
+          prs-artifact: ${{ inputs.prs-artifact }}
           output: ${{ inputs.output }}
           repo: ${{ inputs.repo }}
           owner: ${{ inputs.owner }}

changelog/README.md

@@ -278,15 +278,16 @@ The PR workflow is **fetch-only**: it downloads the already-uploaded, scrubbed b
 
 ### 2. Choose how entries are selected
 
-Pick exactly one — `profile`, `release-version`, `report`, and `prs` are mutually exclusive.
+Pick exactly one filter source — `release-version`, `report`, `prs`, and `prs-artifact` are mutually exclusive. `profile` combines with `version`, and optionally with `report` or `prs-artifact` as the filter source.
 
 | Situation | Mode | Key inputs |
 | --- | --- | --- |
 | You accumulate entry files and tag releases (most teams) | **Profile** _(recommended)_ | `profile` + `version` |
+| You generate the shipped-PR list at release time (e.g. from a commit range) | **Profile + PR list** | `profile` + `version` + `prs-artifact` |
 | You build changelogs from a GitHub release's notes rather than entry files | **gh-release** | `mode: gh-release` + `repo` + `version` |
 | You want everything in a given release tag | **Option** | `release-version` (+ `output`) |
 | You want everything in a Buildkite promotion report | **Option** | `report` (+ `output`) |
-| You want a specific set of PRs | **Option** | `prs` (+ `output`) |
+| You want a specific set of PRs | **Option** | `prs` or `prs-artifact` (+ `output`) |
 
 Each mode has a complete, copy-pasteable workflow file under [Setup](#setup-1).
 
@@ -365,6 +366,86 @@ jobs:
 
 The `output` input is not needed — the action resolves the output path from `bundle.output_directory` and the profile's `output` pattern via the `--plan` step.
 
+#### Profile-based bundling from a PR list (`prs-artifact`)
+
+For releases where the source of truth is a PR list produced at release time (for example, derived from a start/end commit range), generate the list in a preceding job, upload it as a workflow artifact, and pass the artifact name via `prs-artifact`. The artifact must contain exactly one newline-delimited file of fully-qualified GitHub PR URLs — or issue URLs, but not a mix of both:
+
+```txt
+https://github.com/elastic/my-repo/pull/123
+https://github.com/elastic/my-repo/pull/456
+```
+
+In profile mode, `version` is required alongside `prs-artifact`: it drives `{version}`/`{lifecycle}` substitution in the profile's `output` and `output_products` patterns, and the resolved output path depends on it.
+
+The profile supplies the output pattern and product metadata. It must **not** define a `products` pattern — a products filter cannot be combined with a PR-list filter:
+
+```yaml
+bundle:
+  directory: docs/changelog
+  output_directory: docs/releases
+  resolve: true
+  repo: my-repo
+  owner: elastic
+  profiles:
+    my-release:
+      output: "{version}.yaml"
+      output_products: "my-product {version} {lifecycle}"
+```
+
+**`.github/workflows/changelog-bundle.yml`**
+
+```yaml
+name: changelog-bundle
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version (e.g. 9.2.0 or 2026-07-07)'
+        required: true
+
+permissions: {}
+
+jobs:
+  discover-prs:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Build PR list
+        run: |
+          # Replace with your discovery logic (e.g. derive the merged PRs
+          # from a start/end commit range). One fully-qualified URL per line.
+          printf '%s\n' \
+            "https://github.com/elastic/my-repo/pull/123" \
+            "https://github.com/elastic/my-repo/pull/456" > prs.txt
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-prs
+          path: prs.txt
+          if-no-files-found: error
+          retention-days: 1
+
+  bundle:
+    needs: discover-prs
+    permissions:
+      contents: read    # checkout and read release data
+      packages: read    # pull the docs-builder image from GHCR
+      id-token: write   # OIDC token for AWS authentication on the upload job
+    uses: elastic/docs-actions/.github/workflows/changelog-bundle.yml@v1
+    with:
+      profile: my-release
+      version: ${{ inputs.version }}
+      prs-artifact: release-prs
+```
+
+The `version` input drives `{version}`/`{lifecycle}` substitution in the profile's `output` and `output_products` patterns; the artifact supplies the filter. Because the artifact is downloaded inside the reusable workflow, the PR list never needs to be committed to the repository.
+
+> **Note:** `{lifecycle}` is inferred from semver-style prerelease monikers (`9.2.0` → `ga`, `9.2.0-beta.1` → `beta`). Date-based targets such as `2026-07-07` are treated as having a prerelease suffix and infer `preview`, so for date-based releases omit `{lifecycle}` from your patterns (e.g. `output_products: "my-product {version}"`).
+
 #### GitHub release mode (`mode: gh-release`)
 
 For repositories that do not use the validate/submit workflow to accumulate individual changelog files, `gh-release` mode creates changelogs directly from a GitHub release's notes and bundles them in a single step.
@@ -395,7 +476,7 @@ jobs:
 
 #### Option-based bundling with S3 upload
 
-You can also use option-based filtering instead of profiles. The `release-version`, `report`, and `prs` inputs are supported.
+You can also use option-based filtering instead of profiles. The `release-version`, `report`, `prs`, and `prs-artifact` inputs are supported. Option mode has no profile to derive the bundle's product metadata from, so the products are inferred from the matched changelog entries; prefer profile mode when you need explicit `output_products`.
 
 **Stack / product releases:**
 
@@ -454,6 +535,19 @@ jobs:
       output: docs/releases/${{ needs.discover-report.outputs.release-date }}.yaml
 ```
 
+**Specific set of PRs:**
+
+Pass a short list inline with `prs` (comma-separated URLs or numbers, or a path to a newline-delimited file committed to the repository):
+
+```yaml
+    uses: elastic/docs-actions/.github/workflows/changelog-bundle.yml@v1
+    with:
+      prs: "https://github.com/elastic/my-repo/pull/123,https://github.com/elastic/my-repo/pull/456"
+      output: docs/releases/my-bundle.yaml
+```
+
+For PR lists generated during the run, upload the list file as an artifact and pass `prs-artifact` instead — see [Profile-based bundling from a PR list](#profile-based-bundling-from-a-pr-list-prs-artifact), which also works with `output` in option mode.
+
 #### Custom config path
 
 If your changelog configuration is not at `docs/changelog.yml`, pass the path explicitly:

changelog/bundle-create/README.md

@@ -1,6 +1,6 @@
 # Changelog bundle create
 
-Checks out the repository, runs docs-builder in Docker to generate a fully-resolved bundle file, and uploads the result as an artifact. Supports option-based filtering (release-version, report, prs), profile-based bundling, and gh-release mode (creates changelogs from a GitHub release). Uses `--network none` where possible.
+Checks out the repository, runs docs-builder in Docker to generate a fully-resolved bundle file, and uploads the result as an artifact. Supports option-based filtering (release-version, report, prs, prs-artifact), profile-based bundling (optionally filtered by a report or a PR-list artifact), and gh-release mode (creates changelogs from a GitHub release). Uses `--network none` where possible.
 
 ## Modes
 
@@ -23,7 +23,8 @@ CDN sourcing requires a resolvable product. When none can be resolved (e.g. an o
 | `version`              | Version string (e.g. 9.2.0). Profile substitution in bundle mode; release tag in gh-release mode    | `false`  |                       |
 | `release-version`      | GitHub release tag for PR filtering (bundle mode, option-based only)                                | `false`  |                       |
 | `report`               | Buildkite promotion report URL or local file path                                                   | `false`  |                       |
-| `prs`                  | Comma-separated PR URLs/numbers, or path to a newline-delimited file                                | `false`  |                       |
+| `prs`                  | Comma-separated PR URLs/numbers, or path to a newline-delimited file committed to the repo         | `false`  |                       |
+| `prs-artifact`         | Name of a same-run workflow artifact with one newline-delimited file of PR or issue URLs (no mix)  | `false`  |                       |
 | `output`               | Output file path, relative to repo root                                                             | `false`  |                       |
 | `repo`                 | GitHub repository name. Required for gh-release mode                                                | `false`  |                       |
 | `owner`                | GitHub repository owner                                                                             | `false`  |                       |
@@ -49,6 +50,16 @@ steps:
       version: 9.2.0
 ```
 
+Bundle mode (profile + PR-list artifact — the artifact is uploaded by an earlier job in the same run and must contain exactly one newline-delimited file of fully-qualified GitHub PR URLs, or issue URLs, but not both; `version` is required with `profile`):
+```yaml
+steps:
+  - uses: elastic/docs-actions/changelog/bundle-create@v1
+    with:
+      profile: elasticsearch-release
+      version: 9.2.0
+      prs-artifact: release-prs
+```
+
 Bundle mode (option-based):
 ```yaml
 steps: