feat(release): add reusable check-vendored-contracts workflow

Lets consumer repos (openemr/openemr, openemr/website-openemr, any future
one) drift-check their vendored copies of dispatch.schema.json,
TagVerifier.php, and TagVerificationResult.php against canonical with a
single workflow_call line. Encapsulates the canonical openemr-devops
checkout, PHP setup, and the bin/check-vendored.php invocation so each
consumer adopts with one ~6-line workflow file and gets future drift-check
improvements automatically.

Inputs:
  consumer_subpath  required — path within the caller repo holding the
                    vendored copies (e.g. tools/release).
  canonical_ref     optional — defaults to master; pin if a consumer needs
                    a known-good ref while reconciling drift.
  path_overrides    optional — newline-delimited canonical=consumer pairs
                    for consumers that vendored into a non-canonical layout
                    (website-openemr).

Same shape as the reusable-workflow shim the May 8 follow-up on #664
proposes for the conductor itself; building it here at lower stakes
validates the pattern.

Refs #664.

Assisted-by: Claude Code

Author: kojiromike

.github/workflows/check-vendored-contracts.yml

@@ -0,0 +1,100 @@
+name: Check Vendored Contracts
+
+# Reusable workflow consumer repos call to fail their CI when their vendored
+# copies of cross-repo release contracts (dispatch.schema.json, TagVerifier,
+# TagVerificationResult) drift from the canonical sources here.
+#
+# See tools/release/src/VendoredFileChecker.php for the canonical file list.
+# See tools/release/contracts/dispatch.schema.json and
+# tools/release/src/TagVerifier.php for the contracts themselves.
+#
+# Caller example (in a consumer repo's PR workflow):
+#
+#   jobs:
+#     drift:
+#       uses: openemr/openemr-devops/.github/workflows/check-vendored-contracts.yml@master
+#       with:
+#         consumer_subpath: tools/release
+#
+# website-openemr (which vendored into a non-canonical layout) passes overrides:
+#
+#       with:
+#         consumer_subpath: tools/release-docs
+#         path_overrides: |
+#           src/TagVerifier.php=src/Release/TagVerifier.php
+#           src/TagVerificationResult.php=src/Release/TagVerificationResult.php
+
+on:
+  workflow_call:
+    inputs:
+      consumer_subpath:
+        description: 'Path within the caller repo holding the vendored copies (e.g. tools/release).'
+        required: true
+        type: string
+      canonical_ref:
+        description: 'Ref of openemr/openemr-devops to compare against. Defaults to master.'
+        required: false
+        type: string
+        default: master
+      path_overrides:
+        description: |
+          Optional newline-delimited canonical=consumer path overrides for consumers
+          that vendored into a non-canonical layout. Example:
+            src/TagVerifier.php=src/Release/TagVerifier.php
+        required: false
+        type: string
+        default: ''
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: vendored contracts
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout consumer
+        uses: actions/checkout@v6
+
+      - name: Checkout canonical openemr-devops
+        uses: actions/checkout@v6
+        with:
+          repository: openemr/openemr-devops
+          ref: ${{ inputs.canonical_ref }}
+          path: _canonical-openemr-devops
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.5'
+
+      - name: Install canonical release-tools dependencies
+        working-directory: _canonical-openemr-devops/tools/release
+        run: composer install --no-interaction --no-progress --no-dev
+
+      - name: Build override flags
+        id: overrides
+        env:
+          PATH_OVERRIDES: ${{ inputs.path_overrides }}
+        run: |
+          flags=''
+          while IFS= read -r line; do
+              line="${line## }"
+              line="${line%% }"
+              [[ -z $line ]] && continue
+              flags+=" --override $line"
+          done <<< "$PATH_OVERRIDES"
+          {
+              echo "flags<<EOF"
+              echo "$flags"
+              echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Check vendored contracts
+        env:
+          CONSUMER_PATH: ${{ github.workspace }}/${{ inputs.consumer_subpath }}
+          OVERRIDE_FLAGS: ${{ steps.overrides.outputs.flags }}
+        working-directory: _canonical-openemr-devops/tools/release
+        run: |
+          # shellcheck disable=SC2086 # OVERRIDE_FLAGS is a flag list; word-split is intentional
+          php bin/check-vendored.php --consumer "$CONSUMER_PATH" $OVERRIDE_FLAGS