fix(conformance): certify gates fail closed (deps install, whole-tree contract drift via SDK regeneration), keep the GitHub token out of app code across certify and the CI reusables, and move conditional shell out of run: blocks [FND-4244]

.github/actionlint.yaml

@@ -88,6 +88,12 @@ paths:
   .github/workflows/test-commands-reusable.yaml:
     ignore:
       - 'property "workflow_sha" is not defined'
+  # The scoped private-dependency token mint's git_auth.py checkout (lens
+  # round 5 on #4731): the `repos` step runs before a token exists, from the
+  # workflow's own commit.
+  .github/workflows/release-version-bump.yaml:
+    ignore:
+      - 'property "workflow_sha" is not defined'
 
   # FALSE POSITIVE — deliberate kill switch, not dead code left by accident.
   # The job body and its input are retained on purpose so callers that still
@@ -97,3 +103,6 @@ paths:
   .github/workflows/build-and-publish-app.yaml:
     ignore:
       - 'constant expression "false" in condition'
+      # job.workflow_sha: see the FALSE POSITIVE block above (the scoped
+      # private-dependency token mint's git_auth.py checkout).
+      - 'property "workflow_sha" is not defined'

.github/actions/build-app-image/action.yaml

@@ -164,16 +164,15 @@ runs:
     # The script is shared from the sibling action rather than copied a third
     # time. Reaching across action dirs with `../` is the established pattern
     # here (see connector-unit-tests/action.yaml, which reads
-    # connector-integration-tests' copy the same way). Note there are already
-    # two byte-identical copies of this script in the repo; consolidating them
-    # is worth doing, but not as a side effect of this change.
+    # connector-integration-tests' copy the same way). That copy is the only
+    # one; sdr-e2e stashes it too.
     - name: Pin application-sdk to dispatched ref (pre-build)
       if: inputs.application-sdk-ref != ''
       shell: bash
       env:
         SDK_REF: ${{ inputs.application-sdk-ref }}
       run: |
-        "${{ github.action_path }}/../sdr-e2e/repin-application-sdk.sh"
+        "${{ github.action_path }}/../connector-integration-tests/repin-application-sdk.sh"
         if ! command -v uv >/dev/null 2>&1; then
           echo "Installing uv for the pre-build re-lock..."
           "${{ github.action_path }}/../../scripts/with-retry.sh" \

.github/actions/connector-integration-tests/action.yaml

@@ -214,13 +214,23 @@ inputs:
     required: false
     default: ""
 
+  git-auth-token:
+    required: false
+    description: |
+      Read-only GitHub token for a PRIVATE atlanhq git dependency, passed to
+      setup-deps and to the SDK repin's `uv sync`, each through
+      `.github/scripts/git_auth.py` so no git config is written (FND-4740).
+      Empty (the default) installs without one.
+    default: ""
+
 runs:
   using: "composite"
   steps:
     - name: Setup Python, uv, and dependencies
       uses: atlanhq/application-sdk/.github/actions/setup-deps@main
       with:
         python-version: ${{ inputs.python-version }}
+        git-auth-token: ${{ inputs.git-auth-token }}
 
     - name: Pin application-sdk to dispatched ref
       if: inputs.application-sdk-ref != ''
@@ -230,7 +240,7 @@ runs:
       run: |
         chmod +x "${{ github.action_path }}/repin-application-sdk.sh"
         "${{ github.action_path }}/repin-application-sdk.sh"
-        uv sync --all-extras --all-groups
+        python3 "${{ github.action_path }}/../../scripts/git_auth.py" run -- uv sync --all-extras --all-groups
 
     # Regenerate app/generated/** (incl. manifest.json — the AE DAG) from
     # contract/app.pkl before the app server boots, so the host harness exercises

.github/actions/connector-unit-tests/action.yaml

@@ -50,13 +50,23 @@ inputs:
       review too — parity with connector-integration-tests.
     default: ""
 
+  git-auth-token:
+    required: false
+    description: |
+      Read-only GitHub token for a PRIVATE atlanhq git dependency, passed to
+      setup-deps and to the SDK repin's `uv sync`, each through
+      `.github/scripts/git_auth.py` so no git config is written (FND-4740).
+      Empty (the default) installs without one.
+    default: ""
+
 runs:
   using: "composite"
   steps:
     - name: Setup Python, uv, and dependencies
       uses: atlanhq/application-sdk/.github/actions/setup-deps@main
       with:
         python-version: ${{ inputs.python-version }}
+        git-auth-token: ${{ inputs.git-auth-token }}
 
     - name: Pin application-sdk to dispatched ref
       if: inputs.application-sdk-ref != ''
@@ -73,7 +83,7 @@ runs:
         REPIN="${{ github.action_path }}/../connector-integration-tests/repin-application-sdk.sh"
         chmod +x "$REPIN"
         "$REPIN"
-        uv sync --all-extras --all-groups
+        python3 "${{ github.action_path }}/../../scripts/git_auth.py" run -- uv sync --all-extras --all-groups
 
     - name: Run unit tests with coverage
       id: tests