Evaluate reusable workflow adoption: infrastructure

[laurigates]

Repository: infrastructure

Wave: 4 — Special case, needs careful evaluation
Language: HCL | Has Dockerfile: Yes (containers/ subdirs)

Current state

Infrastructure repo has 25+ workflows including its own internal reusable workflows (build-and-push.yaml, release-notification.yaml). Uses direct googleapis/release-please-action@v4 and runs Renovate directly.

Evaluation outcome (2026-04-17)

Task	Decision	Status
Migrate release-please.yaml → reusable-release-please.yml	Defer — blocked on missing inputs	Tracked in #40
Migrate renovate.yml → reusable-renovate.yml	Defer — blocked on missing inputs	Tracked in #41
Add reusable-auto-fix.yml	Adopt	ForumViriumHelsinki/infrastructure#1685
Add reusable-enforce-conventional-commits.yml	Adopt	ForumViriumHelsinki/infrastructure#1685
Add reusable-claude-review.yml	Adopt	ForumViriumHelsinki/infrastructure#1685
Adopt reusable-claude.yml	Already migrated	—

Blockers

• release-please (feat(reusable-release-please): add App-token auth, runner, timeout, skip-on-release-commit inputs #40): reusable workflow needs app-id (GitHub App auth), runner, timeout-minutes, skip-on-release-commit inputs. Infrastructure uses actions/create-github-app-token with CI_APP_ID, runs on ubuntu-slim, has a 15-minute timeout, and skips release-please's own merge commits.
• renovate (feat(reusable-renovate): add App-token and bot-identity inputs #41): reusable workflow needs app-id + bot-identity inputs (RENOVATE_USERNAME, RENOVATE_GIT_AUTHOR). Infrastructure uses the fvh-renovate-bot GitHub App for commit authorship.

Notes

• Many workflows are infrastructure-specific (Helm, Terraform, ArgoCD) and should remain direct.
• Migration must be carefully coordinated to avoid deployment disruptions.

Next steps

1. Merge ForumViriumHelsinki/infrastructure#1685 (adopts the 3 Claude-powered workflows).
2. Resolve feat(reusable-release-please): add App-token auth, runner, timeout, skip-on-release-commit inputs #40 and feat(reusable-renovate): add App-token and bot-identity inputs #41 in this repo to unblock the release-please and Renovate migrations.
3. Re-evaluate release-please and Renovate migrations once feat(reusable-release-please): add App-token auth, runner, timeout, skip-on-release-commit inputs #40 and feat(reusable-renovate): add App-token and bot-identity inputs #41 ship.