Two blockers found while aligning projectbluefin/fsdk-containers with the factory (projectbluefin/fsdk-containers#42).
1. reusable-renovate.yml cannot be used with a Mergeraptor app token.
It validates the token with check-token-health and required_scopes: repo,workflow. That check reads x-oauth-scopes from GET /user, which a GitHub App installation token does not have (and /user is not valid for installation tokens at all). So the only token that passes is a PAT — which is banned org-wide by the very policy pat-ban.yml enforces.
Suggestion: make required_scopes an input defaulting to empty, or have check-token-health detect ghs_/app tokens and validate them via GET /installation/repositories instead. Until then fsdk-containers runs Renovate locally with an app token.
2. reusable-design-enforcement.yml exists only at commit 67d4cfb597e331448e31047a380439bdeee91865.
It is not on main and not at the v1 tag, so a consumer following the documented @v1 convention gets an immediate workflow failure ("workflow was not found"). fsdk-containers has to pin the bare commit, which factory-drift.yml then flags as actions-sha-pin drift.
Please either merge it to main and include it in the next v1 tag move, or remove it from the recommended consumer setup.
Two blockers found while aligning
projectbluefin/fsdk-containerswith the factory (projectbluefin/fsdk-containers#42).1.
reusable-renovate.ymlcannot be used with a Mergeraptor app token.It validates the token with
check-token-healthandrequired_scopes: repo,workflow. That check readsx-oauth-scopesfromGET /user, which a GitHub App installation token does not have (and/useris not valid for installation tokens at all). So the only token that passes is a PAT — which is banned org-wide by the very policypat-ban.ymlenforces.Suggestion: make
required_scopesan input defaulting to empty, or havecheck-token-healthdetectghs_/app tokens and validate them viaGET /installation/repositoriesinstead. Until thenfsdk-containersruns Renovate locally with an app token.2.
reusable-design-enforcement.ymlexists only at commit67d4cfb597e331448e31047a380439bdeee91865.It is not on
mainand not at thev1tag, so a consumer following the documented@v1convention gets an immediate workflow failure ("workflow was not found").fsdk-containershas to pin the bare commit, whichfactory-drift.ymlthen flags asactions-sha-pindrift.Please either merge it to
mainand include it in the nextv1tag move, or remove it from the recommended consumer setup.