Add markdown-exclude-globs Input to validate-task.yml

.github/workflows/validate-task.yml

@@ -3,10 +3,17 @@ name: Validate task
 # The fleet validation gate, hosted here once and reached by every repo's test-pull-request stub and its own publish-release stub.
 # Three jobs: lint (the fleet doc-lint block plus language lint by tree detection, the prose gate, and the repo gate), unit-test (a generic dotnet test or uv run pytest, skipped where the caller has no test project), and validate (the validate hook, a repo's own domain checks such as an ESPHome compile, a Hugo build, a KiCad ERC, a codegen-drift check, or PowerShell tests).
 # No permissions beyond contents: read where a job needs one, since every job here only checks out and reads.
-# No required inputs, and CODECOV_TOKEN is the one optional secret, since coverage upload is best-effort.
+# No required inputs, markdown-exclude-globs is the one optional input, and CODECOV_TOKEN is the one optional secret, since coverage upload is best-effort.
 # Hub-owned gates and default hooks resolve through $/ at the reusable workflow's commit, so each implementation is reproducible against the caller's released pin without a second checkout.
 on:
  workflow_call:
+ inputs:
+ # Appended after '**/*.md', not validated: a negated glob excludes, a non-negated one adds to what is linted.
+ markdown-exclude-globs:
+ description: Negated globs to exclude, one per line (for example '!content/**'), appended after '**/*.md'. A non-negated line adds to what is linted rather than narrowing it.
+ required: false
+ type: string
+ default: ''
  secrets:
  CODECOV_TOKEN:
  required: false
@@ -29,10 +36,13 @@ jobs:
  fetch-depth: 0
 
  # The fleet doc-lint block, hosted once rather than carried by every repo of every type.
+ # An empty markdown-exclude-globs leaves a blank line here, which the action ignores, so the default caller passes nothing extra.
  - name: Lint Markdown step
  uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
  with:
- globs: '**/*.md'
+ globs: |
+ **/*.md
+ ${{ inputs.markdown-exclude-globs }}
 
  # The spell check covers README + HISTORY only, per CODESTYLE.md "Markdown and Spelling".
  - name: Spell check step

docs/reusable-workflows.md

@@ -349,6 +349,22 @@ jobs:
  done
 ```
 
+A repo that vendors a theme or imports content it does not author narrows the Lint Markdown step's glob instead. Blog carries a WordPress archive and the PaperMod theme, for instance. `.markdownlint-cli2.jsonc` is declared `"fidelity": "verbatim", "whole": true` in `spec/files.json`, so it is not locally editable:
+
+```yaml
+ validate:
+ name: Validate sources job
+ uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@<hub-main-commit-sha> # <release-tag>
+ permissions:
+ contents: read
+ with:
+ markdown-exclude-globs: |
+ !content/**
+ !themes/*/**
+```
+
+`validate-task.yml` appends each line after `**/*.md` in the Lint Markdown step's own `globs:` block, unvalidated. A negated glob excludes, the intended use, but a non-negated one adds to what is linted rather than narrowing it.
+
 ## Adopting the Pure Functions
 
 Neither `get-version-task.yml` nor `publish-plan-task.yml` has a caller-stub snippet of its own, since a caller reaching either one is a job inside a repo's own `publish-release.yml` or a future `build-release-task.yml`, not a standalone top-level workflow. A repo whose publisher reads NBGV's version outputs directly, without carrying the whole release orchestrator, reaches `get-version-task.yml` by pin in place of its own copy: