Shared actions must not depend on the gh CLI (self-hosted runners)

[oto-macenauer-absa]

Problem

Both shared composite actions — actions/publish-docs and actions/publish-single-page-docs — shell out to the gh CLI in their publishing steps:

• resolving the release tag when release-tag is not given (gh api repos/…/releases/latest, then gh api repos/…/releases?per_page=1)
• attaching the artifact (gh release upload … --clobber)
• notifying a deployment repository (gh api repos/…/dispatches --method POST, publish-docs only)

gh is preinstalled on GitHub-hosted runners but is not part of the runner itself. On a self-hosted runner without it the upload step fails with gh: command not found after the artifact has already been built, and the consuming repo has no way to fix that short of provisioning the CLI on every runner.

The actions should not assume anything about the runner image beyond what the runner guarantees.

Proposal

Replace every gh invocation with actions/github-script, which ships its own Node runtime and an authenticated Octokit client:

• release lookup → repos.getLatestRelease / repos.listReleases / repos.getReleaseByTag
• upload with clobber → delete any existing kb-docs.tar.gz asset, then POST to the release's upload_url (so GitHub Enterprise upload hosts work too, instead of a hard-coded uploads.github.com)
• notify → repos.createDispatchEvent, still non-fatal

Keep all consumer-controlled values flowing through env, never interpolated into the script body (same rule as #55). Pin actions/github-script by commit SHA like the other actions.

The remaining run: steps (npm ci, node …/src/index.js) are single commands and stay on shell: bash; document that bash and network access to the GitHub API are the only runner requirements, since Node comes from actions/setup-node.

Related: scripts/fetch-apps.js falls back to gh api when GITHUB_TOKEN is unset. The reusable build-image.yml workflow should default the token to github.token so a deployment that omits docs-token (public docs repos) does not hit that fallback on a runner without gh, and the fallback itself should say what to do when gh is missing.

Acceptance

• No gh invocation in actions/**/action.yml
• actions/github-script pinned by SHA
• Both READMEs describe the runner requirements
• build-image.yml no longer depends on gh when docs-token is omitted