Retarget changelog evaluate staging to changelog-ci/

[lcawl]

Relates to elastic/docs-builder#3913 (merged).

Problem

changelog-submit was writing staging/artifact files under .artifacts/.... That is a hidden directory, so:

1. docs-builder ScopedFileSystem rejected the path (fixed in docs-builder for callers that still use .artifacts).
2. actions/upload-artifact skips hidden paths by default, so upload can fail with “no files found”.

Using include-hidden-files: true was rejected in review: hidden dirs are denied for a reason; the output path should not require that option.

Fix

Retarget evaluate staging/upload to a non-hidden in-repo directory:

• changelog-ci/changelog-staging — mkdir, changelog add --output, prepare-artifact --staging-dir
• changelog-ci/changelog-artifact — prepare-artifact --output-dir, upload-artifact path

Artifact name stays changelog-staging, so apply still downloads to /tmp/changelog-staging unchanged.

No docs-builder changes are required for this path; changelog-ci/ is already in scope for ChangelogFileSystem / RunnerTempFileSystem.

Notes for reviewers

No per-repo setup is required for changelog-ci/ to work.

Evaluate creates it on the runner with mkdir -p changelog-ci/changelog-staging after checkout. That’s a normal writable workspace dir — no permissions, branch rules, or pre-created folder in the team repos.

Nothing in that folder is committed. Apply only git adds the real changelog YAML under the configured changelog directory (e.g. docs/changelog/…). Staging lives under changelog-ci/ on the evaluate job, is uploaded as the changelog-staging artifact, then apply unpacks it to /tmp/changelog-staging. The job workspace goes away when the run ends.

.gitignore updates are not required for the action. docs-content (for example) already ignores .artifacts, which covered the old path; changelog-ci/ is a different name and isn’t needed for CI.

Optional hygiene: add changelog-ci/ to a consumer .gitignore only if people might run the same local paths and accidentally commit junk. That’s convenience, not a prerequisite for using the action.

[Mpdreamz]

We deny hidden files and folders for a reason. This option should not exist in the first place IMO.

The output path shpuld be configured in the allowed set.

[lcawl]

We deny hidden files and folders for a reason. This option should not exist in the first place IMO.

The output path shpuld be configured in the allowed set.

I've added b467140
Lmk if that's not what you had in mind.