Ship reusable consumer email-template publish workflow from PostKit

[patoperpetua]

Goal

Stop each consumer from copying and maintaining its own post-kit-publish CI wiring. PostKit owns the Blob store (tenants/{tenant}/{env}/templates/…); consumers should call a PostKit-published reusable workflow / composite action (plus any shared compile helper) instead of forking docs/examples/publish-email-templates.yml and local compile scripts.

InkAds marketing already landed a one-off consumer implementation (poc-inkads-marketing #100 / PR #111). That should become a thin caller of whatever PostKit ships here, then be slimmed.

Scope

In scope

• Publish a reusable GitHub Actions workflow and/or composite action from singleton-sd/post-kit that:
  • Compiles content/email-templates/** (fail CI on compile errors; no upload)
  • On publishing branches / workflow_dispatch, runs post-kit-publish with OIDC (azure/login + DefaultAzureCredential)
  • Writes only under tenants/{tenant}/{environment}/templates/{key}/ on PostKit-owned storage (account/container configured by PostKit; not a per-consumer Blob account)
• Accept consumer inputs such as: tenant, templates-path (default content/email-templates), environment selection rules, optional storage overrides only if PostKit moves the store
• Document the single integration path in docs/guides/template-publishing.md (replace “copy this example YAML into every consumer”)
• Optionally expose the same compile helper as a package script / small CLI used by the workflow so local pnpm templates:compile-style checks stay consistent
• Migration note for consumers (InkAds first): replace inlined workflow/scripts with a one-liner uses: singleton-sd/post-kit/.github/workflows/…@vX

Out of scope

• Changing blob path layout or moving ownership of the storage account to consumers
• Putting POSTKIT_API_KEY, storage keys, or connection strings in GitHub Secrets
• EmailTemplateAdmin UI (Epic: Full embeddable EmailTemplateAdmin page component #138–Add EmailTemplateAdmin page component (list + chrome + ThemeProvider) #140)
• Send-test BFF (consumer-side)

Acceptance criteria

• PostKit ships a versioned reusable workflow and/or composite action that a consumer can call with tenant + path inputs
• PR-only path compiles without requiring Blob write; publish path uses OIDC only (same auth model as today’s example)
• Docs tell consumers to call the PostKit artifact, not copy-paste YAML
• Example / guide covers RBAC: consumer OIDC identity needs Blob data-plane write on PostKit’s template container (or agreed narrower scope); App Config reader alone is not enough
• InkAds marketing can open a follow-up PR that deletes its duplicated workflow/compile script and calls PostKit instead (tracked separately in poc-inkads-marketing)

Dependencies

Parent: (none — Infra/CI + Docs; related to template publishing, not #138)

Related consumer proof:

• poc-inkads-marketing feat: HMAC recipientHash with Key Vault key version #100 / PR fix(release): link GitHub Releases to npmjs package pages #111 (merged consumer copy to replace)

Constraints

• Blob storage remains PostKit-owned; consumers publish into tenants/<tenant>/… only
• No storage account keys, connection strings, SAS, or AZURE_CREDENTIALS secrets
• Keep fail-fast compile semantics of post-kit-publish (no upload if any template fails)
• Public repo: no secrets or commercially sensitive content in the issue or samples

Technical references

• Current copy-paste example: docs/examples/publish-email-templates.yml
• Guide: docs/guides/template-publishing.md
• CLI: @singleton-sd/post-kit-publisher (post-kit-publish)
• Consumer implementation to retire: poc-inkads-marketing .github/workflows/publish-email-templates.yml + scripts/compile-email-templates.mjs

Agent-ready checklist

• Goal/problem statement is clear
• Scope is sufficient to start work without further business clarification
• Acceptance criteria are explicit
• Relevant constraints are stated
• No unresolved blocking dependency (Depends on)