invoke run-changesets package instead of duplicating its code

CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to the InProd Run Changesets GitHub Action will be documente
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+
+- **Internal: now wraps the `run-changesets` CLI instead of duplicating its logic** — this action's changeset validation/execution/polling logic (`pollTask`, `validateFile`, `executeFile`, `resolveFiles`, etc.) was a hand-maintained copy of the same logic in the [`@inprod.io/run-changesets`](https://www.npmjs.com/package/@inprod.io/run-changesets) npm package. The two copies had already drifted (differing `Content-Type` handling on status polling, missing `INPROD_FILES` support here). This action now contains no changeset logic of its own — it maps its inputs to the `INPROD_*` environment variables `run-changesets` reads, spawns it as a subprocess, and maps its result files back into Action outputs. No change to inputs/outputs behavior, aside from the addition below.
+
+### Added
+
+- **`inprod_files` input** — upload files to InProd's temporary storage before running the changeset, in `VARNAME=path` format; their signed URLs are injected as changeset variables. Previously only available via the `run-changesets` CLI; now available here too as a direct consequence of the change above.
+
 ## [1.0.1] - 2026-02-18
 
 ### Fixed

README.md

@@ -278,6 +278,23 @@ changeset_variables: |
 3. InProd substitutes variable placeholders in the changeset with provided values
 4. Changeset file remains clean and secret-free in version control
 
+### `inprod_files` (optional)
+
+**Description:** Files to upload to InProd's temporary storage before running the changeset, in `VARNAME=path` format
+
+**Default:** None
+
+**Purpose:** Lets a changeset reference the contents of a file (e.g. a certificate, a config bundle) as an injected variable, without embedding the file's contents directly in the changeset or in `changeset_variables`. Each uploaded file's signed URL is merged into the changeset variables under the given name.
+
+**Format:** `VARNAME=path` pairs (one per line), same conventions as `changeset_variables`. See the [run-changesets README](https://github.com/inprod/run-changesets) for the full variable-name validation rules and upload behavior — this input passes straight through to it.
+
+**Example:**
+```yaml
+inprod_files: |
+  TLS_CERT=./certs/server.pem
+  CONFIG_BUNDLE=./bundles/prod.zip
+```
+
 ## Output Reference
 
 ### `status`

action.yml

@@ -38,6 +38,9 @@ inputs:
   changeset_variables:
     description: 'Changeset variables in KEY=VALUE format (one per line). Allows injecting secrets from GitHub Secrets without storing in version control. See README for examples.'
     required: false
+  inprod_files:
+    description: 'Files to upload to temporary storage before running the changeset, in VARNAME=path format (one per line). Uploaded URLs are injected as changeset variables. See the run-changesets README for details.'
+    required: false
 
 outputs:
   status: