feat(workflows): add ingress dynamic routing for obs and docs

.cursor/rules/protected-oblt-aw-workflow.mdc

@@ -1,14 +1,14 @@
 ---
-description: Client workflow templates live under remote-workflow-template only
+description: Client workflows — `.github/remote-workflow-template/obs/`
 alwaysApply: true
 ---
 
 # Client workflows — `.github/remote-workflow-template/obs/`
 
-**Do not** add a monolithic `.github/workflows/oblt-aw.yml` entrypoint (removed).
+**Do not** add per-workflow `trigger-oblt-aw-*.yml` client entrypoints.
 
-**Where to change consumer entrypoints:** [`.github/remote-workflow-template/obs/.github/workflows/trigger-oblt-aw-*.yml`](.github/remote-workflow-template/obs/.github/workflows/) only. Distribution installs that tree into target repositories.
+**Where to change consumer entrypoints:** [`.github/remote-workflow-template/obs/.github/workflows/trigger-oblt-aw.yml`](.github/remote-workflow-template/obs/.github/workflows/trigger-oblt-aw.yml) and [`.github/remote-workflow-template/obs/.github/workflows/oblt-aw.yml`](.github/remote-workflow-template/obs/.github/workflows/oblt-aw.yml) only. Distribution installs that tree into target repositories.
 
-**Control-plane reusables** live under `.github/workflows/oblt-aw-*.yml` and `.github/workflows/docs-aw-*.yml` (shared prelude: `aw-prelude.yml`). **Do not** edit consumer copies under target repos from this repository except via distribution.
+**Control-plane reusables** live under `.github/workflows/oblt-aw-*.yml` (ingress: `oblt-aw-ingress.yml`; shared prelude: `aw-prelude.yml`). **Do not** edit consumer copies under target repos from this repository except via distribution.
 
 **Docs:** [docs/workflows/oblt-aw-client-template.md](docs/workflows/oblt-aw-client-template.md), [CONTRIBUTING.md](CONTRIBUTING.md).

.github/remote-workflow-template/docs/.github/workflows/docs-aw.yml

@@ -0,0 +1,61 @@
+name: Docs Agentic Workflow Entrypoint
+
+on:
+  workflow_dispatch:
+    inputs:
+      trigger-source:
+        description: Client trigger workflow file that dispatched this run
+        required: true
+        type: string
+      event-name:
+        description: Original github.event_name from the trigger
+        required: true
+        type: string
+      event-action:
+        description: Original github.event.action from the trigger
+        required: false
+        type: string
+        default: ''
+      event-payload-json:
+        description: JSON-encoded original github.event from the trigger
+        required: true
+        type: string
+      caller-ref:
+        description: Original github.ref from the trigger
+        required: true
+        type: string
+      caller-sha:
+        description: Original github.sha from the trigger
+        required: true
+        type: string
+      caller-run-id:
+        description: Original github.run_id from the trigger
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docs-aw-entrypoint-${{ github.event.inputs.event-name }}-${{ github.event.inputs.caller-run-id }}
+  cancel-in-progress: true
+
+jobs:
+  ingress:
+    permissions:
+      actions: write
+      contents: read
+      id-token: write
+      issues: read
+      pull-requests: read
+    uses: elastic/oblt-aw/.github/workflows/docs-aw-ingress.yml@main # ratchet:exclude
+    with:
+      trigger-source: ${{ github.event.inputs.trigger-source }}
+      ingress-event-name: ${{ github.event.inputs.event-name }}
+      ingress-event-action: ${{ github.event.inputs.event-action }}
+      ingress-event-payload-json: ${{ github.event.inputs.event-payload-json }}
+      caller-ref: ${{ github.event.inputs.caller-ref }}
+      caller-sha: ${{ github.event.inputs.caller-sha }}
+      caller-run-id: ${{ github.event.inputs.caller-run-id }}
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/remote-workflow-template/docs/.github/workflows/trigger-docs-aw.yml

@@ -0,0 +1,83 @@
+name: Docs Agentic Workflow Trigger
+
+# Distributed to repositories in config/docs/active-repositories.json.
+
+on:
+  issues:
+    types: [opened]
+  issue_comment:
+    types: [edited]
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+  workflow_run:
+    workflows: [Docs Agentic Workflow Trigger]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      issue_number:
+        description: Issue number for Docs AI issue menu (manual refresh).
+        required: false
+        type: string
+      pull_request_number:
+        description: Pull request number for Docs PR AI menu (manual refresh).
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docs-aw-trigger-${{ github.event.pull_request.number || github.event.issue.number || github.event.workflow_run.id || github.event.schedule || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  dispatch-entrypoint:
+    if: >-
+      github.event_name != 'workflow_run' ||
+      (
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'pull_request'
+      )
+    permissions:
+      actions: write
+      statuses: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Dispatch docs-aw entrypoint
+        id: dispatch
+        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          workflow: docs-aw.yml
+          inputs: |
+            {
+              "trigger-source": ${{ toJSON(github.workflow) }},
+              "event-name": ${{ toJSON(github.event_name) }},
+              "event-action": ${{ toJSON(github.event.action || '') }},
+              "event-payload-json": ${{ toJSON(toJSON(github.event)) }},
+              "caller-ref": ${{ toJSON(github.ref) }},
+              "caller-sha": ${{ toJSON(github.sha) }},
+              "caller-run-id": ${{ toJSON(github.run_id) }}
+            }
+
+      - name: Post entrypoint run link on PR commit
+        if: >-
+          github.event_name == 'pull_request' ||
+          (github.event_name == 'workflow_run' &&
+            github.event.workflow_run.event == 'pull_request')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_SHA: >-
+            ${{ github.event.pull_request.head.sha ||
+                github.event.workflow_run.head_sha }}
+          RUN_URL: ${{ steps.dispatch.outputs.runUrlHtml }}
+          STATUS_CONTEXT: docs-aw/entrypoint
+        run: |
+          gh api \
+            --method POST \
+            "/repos/${GITHUB_REPOSITORY}/statuses/${HEAD_SHA}" \
+            -f state=success \
+            -f target_url="${RUN_URL}" \
+            -f description='docs-aw entrypoint dispatched (open run for progress)' \
+            -f context="${STATUS_CONTEXT}"

.github/remote-workflow-template/obs/.github/workflows/oblt-aw.yml

@@ -0,0 +1,62 @@
+name: Observability Agentic Workflow Entrypoint
+
+on:
+  workflow_dispatch:
+    inputs:
+      trigger-source:
+        description: Client trigger workflow file that dispatched this run
+        required: true
+        type: string
+      event-name:
+        description: Original github.event_name from the trigger
+        required: true
+        type: string
+      event-action:
+        description: Original github.event.action from the trigger
+        required: false
+        type: string
+        default: ''
+      event-payload-json:
+        description: JSON-encoded original github.event from the trigger
+        required: true
+        type: string
+      caller-ref:
+        description: Original github.ref from the trigger
+        required: true
+        type: string
+      caller-sha:
+        description: Original github.sha from the trigger
+        required: true
+        type: string
+      caller-run-id:
+        description: Original github.run_id from the trigger
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: oblt-aw-entrypoint-${{ github.event.inputs.event-name }}-${{ github.event.inputs.caller-run-id }}
+  cancel-in-progress: true
+
+jobs:
+  ingress:
+    permissions:
+      actions: write
+      contents: read
+      id-token: write
+      issues: read
+      pull-requests: read
+    uses: elastic/oblt-aw/.github/workflows/oblt-aw-ingress.yml@main # ratchet:exclude
+    with:
+      trigger-source: ${{ github.event.inputs.trigger-source }}
+      ingress-event-name: ${{ github.event.inputs.event-name }}
+      ingress-event-action: ${{ github.event.inputs.event-action }}
+      ingress-event-payload-json: ${{ github.event.inputs.event-payload-json }}
+      caller-ref: ${{ github.event.inputs.caller-ref }}
+      caller-sha: ${{ github.event.inputs.caller-sha }}
+      caller-run-id: ${{ github.event.inputs.caller-run-id }}
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+      BUILDKITE_API_TOKEN: ${{ secrets.BUILDKITE_LOGS_API_TOKEN }}