ACS-12583 Backport GitHub app tokens migration (#4338)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

.github/actions/get-downstream-commit-message/action.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+set -euo pipefail
+
+force_prefix=""
+allow_empty_commit="false"
+if [[ "${COMMIT_TITLE}" =~ (\[force[^]]*\]) ]]; then
+    force_prefix="${BASH_REMATCH[1]}"
+    if [[ "${TRIGGER_RELEASE_ON_FORCE:-false}" == "true" ]]; then
+        force_prefix="${force_prefix}[release][skip tests]"
+    fi
+    allow_empty_commit="true"
+fi
+
+directives_prefix=""
+if [[ -n "${DIRECTIVES:-}" ]]; then
+    directives="${DIRECTIVES}"
+    if [[ "${COMMIT_TITLE}" =~ \[publish\] ]] && [[ "${directives}" != *"[publish]"* ]]; then
+        directives="${directives}[publish]"
+    fi
+    directives_prefix="${directives}"
+fi
+
+# Build the message: tokens are concatenated without spaces; a single trailing
+# space separates the token block from the message body.
+if [[ -n "${force_prefix}${directives_prefix}" ]]; then
+    token_block="${force_prefix}${directives_prefix} "
+else
+    token_block=""
+fi
+
+if [[ -z "${DOWNSTREAM_REPO:-}" ]]; then
+    message="${token_block}${VERSION}"
+else
+    message="${token_block}Update ${DOWNSTREAM_REPO} version to ${VERSION}"
+fi
+message="${message//$'\n'/ }"
+message="${message//$'\r'/ }"
+
+if [[ -n "${PENDING_DOWNSTREAM:-}" ]]; then
+    if [[ "${BRANCH_NAME}" == "master" ]]; then
+        directive="[skip docker_latest]"
+    else
+        directive="[skip docker_release]"
+    fi
+    message="${message}
+
+${directive} until ${PENDING_DOWNSTREAM} triggers the build or it is built manually"
+fi
+
+printf 'allow-empty-commit=%s\n' "${allow_empty_commit}" >> "$GITHUB_OUTPUT"
+{
+    printf 'message<<EOF\n'
+    printf '%s\n' "${message}"
+    printf 'EOF\n'
+} >> "$GITHUB_OUTPUT"

.github/actions/get-downstream-commit-message/action.yml

@@ -0,0 +1,76 @@
+name: "Get downstream commit message"
+description: >
+  Computes the commit message and allow-empty-commit flag for a downstream version-bump commit.
+
+  If the upstream commit title contains a [force...] token (e.g. [force] or [force ci]),
+  that token is prepended to the message and allow-empty-commit is set to true, so the downstream
+  commit is created even when no files changed.
+
+  If trigger-release-on-force is set to 'true' and a [force...] token is present, [release][skip
+  tests] is appended directly after the force token so the downstream repo triggers its own release.
+
+  If directives is set (e.g. '[release]'), those tokens are prepended to the message body.
+  '[publish]' is appended to directives automatically when the upstream commit title contains a
+  [publish] token (producing e.g. '[release][publish]').
+
+  If downstream-repo is omitted the message body is the bare version string (e.g. '[release]
+  26.3.0-A.4') instead of 'Update <repo> version to <version>'.
+
+  If pending-downstream is provided, a directive is appended indicating that the build should be
+  skipped until that downstream repo triggers it: "[skip docker_latest/docker_release] until
+  <pending-downstream> triggers the build or it is built manually".
+
+inputs:
+  commit-title:
+    description: "Upstream commit title to inspect for a [force...] token"
+    required: true
+  version:
+    description: "Version string to embed in the commit message"
+    required: true
+  downstream-repo:
+    description: "Short name of the downstream repository (e.g. 'enterprise-repo'). When provided, the message body is 'Update <downstream-repo> version to <version>'. When omitted, the body is just the bare version string (e.g. '[release] 26.3.0-A.4')."
+    required: false
+    default: ""
+  pending-downstream:
+    description: "Name of the downstream repo that will trigger the real build (e.g. alfresco-enterprise-share). When set, a skip directive is appended."
+    required: false
+    default: ""
+  branch-name:
+    description: "Current branch name, used to pick the correct skip directive (master → skip docker_latest, else → skip docker_release). Only used when pending-downstream is set."
+    required: false
+    default: ""
+  trigger-release-on-force:
+    description: "Set to 'true' (string) to append [release][skip tests] directly after the [force...] token when one is present, so the downstream repo triggers its own release. Defaults to 'false' for backward compatibility."
+    required: false
+    default: "false"
+  directives:
+    description: >
+      Base directives to prepend to the message (e.g. '[release]'). When set, '[publish]' is
+      appended automatically if the upstream commit title contains a [publish] token
+      (producing e.g. '[release][publish]'). Defaults to empty for backward compatibility.
+    required: false
+    default: ""
+
+outputs:
+  message:
+    description: "Commit message to use for the downstream version-bump commit"
+    value: ${{ steps.compute.outputs.message }}
+  allow-empty-commit:
+    description: "Whether to allow an empty commit (true when a [force...] token was detected)"
+    value: ${{ steps.compute.outputs.allow-empty-commit }}
+
+runs:
+  using: composite
+  steps:
+    - name: Compute downstream commit message
+      id: compute
+      env:
+        COMMIT_TITLE: ${{ inputs.commit-title }}
+        VERSION: ${{ inputs.version }}
+        DOWNSTREAM_REPO: ${{ inputs.downstream-repo }}
+        PENDING_DOWNSTREAM: ${{ inputs.pending-downstream }}
+        BRANCH_NAME: ${{ inputs.branch-name }}
+        TRIGGER_RELEASE_ON_FORCE: ${{ inputs.trigger-release-on-force }}
+        DIRECTIVES: ${{ inputs.directives }}
+      shell: bash
+      run: ${{ github.action_path }}/action.sh

.github/actions/get-downstream-commit-message/tests/get-downstream-commit-message.bats

@@ -0,0 +1,447 @@
+#!/usr/bin/env bats
+
+setup() {
+    DIR="$( cd "$( dirname "$BATS_TEST_FILENAME" )" >/dev/null 2>&1 && pwd )"
+    ACTION_SCRIPT="$DIR/../action.sh"
+
+    export GITHUB_OUTPUT="$BATS_TMPDIR/test_downstream_msg_ghoutput_${RANDOM}.log"
+    > "$GITHUB_OUTPUT"
+
+    export COMMIT_TITLE="ACS-123: some regular change"
+    export VERSION="1.2.3"
+    export DOWNSTREAM_REPO="community-repo"
+    export PENDING_DOWNSTREAM=""
+    export BRANCH_NAME=""
+    export TRIGGER_RELEASE_ON_FORCE="false"
+    export DIRECTIVES=""
+}
+
+teardown() {
+    rm -f "$GITHUB_OUTPUT"
+}
+
+# helper: read a named output from $GITHUB_OUTPUT
+# handles both key=value and heredoc (key<<EOF / value lines / EOF) formats
+get_output() {
+    local key="$1"
+    # heredoc format: key<<EOF\n...\nEOF
+    if grep -q "^${key}<<EOF" "$GITHUB_OUTPUT"; then
+        awk "/^${key}<<EOF/{found=1; next} found && /^EOF/{exit} found{print}" "$GITHUB_OUTPUT"
+    else
+        grep "^${key}=" "$GITHUB_OUTPUT" | cut -d= -f2-
+    fi
+}
+
+@test "plain commit produces version-bump message" {
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "Update community-repo version to 1.2.3" ]
+}
+
+@test "plain commit sets allow-empty-commit=false" {
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output allow-empty-commit)" = "false" ]
+}
+
+@test "[force] token is prepended to the message" {
+    export COMMIT_TITLE="[force] ACS-123: trigger downstream CI"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[force] Update community-repo version to 1.2.3" ]
+}
+
+@test "[force] token sets allow-empty-commit=true" {
+    export COMMIT_TITLE="[force] ACS-123: trigger downstream CI"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output allow-empty-commit)" = "true" ]
+}
+
+@test "[force ci] qualified token is preserved" {
+    export COMMIT_TITLE="[force ci] ACS-456: force with qualifier"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[force ci] Update community-repo version to 1.2.3" ]
+}
+
+@test "[force ci] qualified token sets allow-empty-commit=true" {
+    export COMMIT_TITLE="[force ci] ACS-456: force with qualifier"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output allow-empty-commit)" = "true" ]
+}
+
+@test "downstream-repo name is embedded in message" {
+    export DOWNSTREAM_REPO="enterprise-repo"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "Update enterprise-repo version to 1.2.3" ]
+}
+
+@test "version is embedded in message" {
+    export VERSION="7.4.0"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "Update community-repo version to 7.4.0" ]
+}
+
+@test "[force] token mid-title is extracted correctly" {
+    export COMMIT_TITLE="ACS-789: some change [force] in the middle"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[force] Update community-repo version to 1.2.3" ]
+    [ "$(get_output allow-empty-commit)" = "true" ]
+}
+
+# downstream-repo omitted → bare version body
+
+@test "downstream-repo omitted produces bare version as message body" {
+    unset DOWNSTREAM_REPO
+    export VERSION="26.3.0-A.4"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "26.3.0-A.4" ]
+}
+
+@test "downstream-repo empty produces bare version as message body" {
+    export DOWNSTREAM_REPO=""
+    export VERSION="26.3.0-A.4"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "26.3.0-A.4" ]
+}
+
+@test "downstream-repo omitted with directives=[release] produces '[release] <version>'" {
+    unset DOWNSTREAM_REPO
+    export DIRECTIVES="[release]"
+    export VERSION="26.3.0-A.4"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[release] 26.3.0-A.4" ]
+}
+
+@test "downstream-repo omitted with directives=[release] and [publish] produces '[release][publish] <version>'" {
+    unset DOWNSTREAM_REPO
+    export DIRECTIVES="[release]"
+    export COMMIT_TITLE="ACS-123: publish this [publish]"
+    export VERSION="26.2.0"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[release][publish] 26.2.0" ]
+}
+
+@test "downstream-repo omitted with [force] prefixes force token before version" {
+    unset DOWNSTREAM_REPO
+    export COMMIT_TITLE="[force] ACS-123: force release"
+    export VERSION="26.3.0-A.4"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[force] 26.3.0-A.4" ]
+    [ "$(get_output allow-empty-commit)" = "true" ]
+}
+
+@test "downstream-repo omitted does not include repo name in message" {
+    unset DOWNSTREAM_REPO
+    export DIRECTIVES="[release]"
+    export VERSION="26.3.0-A.4"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [[ "$(get_output message)" != *"version to"* ]]
+}
+
+# pending-downstream tests
+
+@test "pending-downstream appends skip docker_release directive on non-master branch" {
+    export PENDING_DOWNSTREAM="alfresco-enterprise-share"
+    export BRANCH_NAME="feature/ACS-123"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    expected="Update community-repo version to 1.2.3
+
+[skip docker_release] until alfresco-enterprise-share triggers the build or it is built manually"
+    [ "$(get_output message)" = "$expected" ]
+}
+
+@test "pending-downstream appends skip docker_latest directive on master branch" {
+    export PENDING_DOWNSTREAM="alfresco-enterprise-share"
+    export BRANCH_NAME="master"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    expected="Update community-repo version to 1.2.3
+
+[skip docker_latest] until alfresco-enterprise-share triggers the build or it is built manually"
+    [ "$(get_output message)" = "$expected" ]
+}
+
+@test "pending-downstream embeds the correct repo name in directive" {
+    export PENDING_DOWNSTREAM="some-other-repo"
+    export BRANCH_NAME="feature/ACS-123"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [[ "$(get_output message)" == *"until some-other-repo triggers the build"* ]]
+}
+
+@test "pending-downstream does not affect allow-empty-commit" {
+    export PENDING_DOWNSTREAM="alfresco-enterprise-share"
+    export BRANCH_NAME="feature/ACS-123"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output allow-empty-commit)" = "false" ]
+}
+
+@test "[force] token combined with pending-downstream prepends force and appends directive" {
+    export COMMIT_TITLE="[force] ACS-123: trigger downstream CI"
+    export PENDING_DOWNSTREAM="alfresco-enterprise-share"
+    export BRANCH_NAME="feature/ACS-123"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    expected="[force] Update community-repo version to 1.2.3
+
+[skip docker_release] until alfresco-enterprise-share triggers the build or it is built manually"
+    [ "$(get_output message)" = "$expected" ]
+    [ "$(get_output allow-empty-commit)" = "true" ]
+}
+
+@test "empty pending-downstream produces plain version-bump message" {
+    export PENDING_DOWNSTREAM=""
+    export BRANCH_NAME="feature/ACS-123"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "Update community-repo version to 1.2.3" ]
+}
+
+# trigger-release-on-force tests
+
+@test "trigger-release-on-force=false with [force] does not add [release][skip tests]" {
+    export COMMIT_TITLE="[force] ACS-123: trigger downstream CI"
+    export TRIGGER_RELEASE_ON_FORCE="false"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[force] Update community-repo version to 1.2.3" ]
+}
+
+@test "trigger-release-on-force omitted with [force] does not add [release][skip tests]" {
+    export COMMIT_TITLE="[force] ACS-123: trigger downstream CI"
+    unset TRIGGER_RELEASE_ON_FORCE
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[force] Update community-repo version to 1.2.3" ]
+}
+
+@test "trigger-release-on-force=true with [force] appends [release][skip tests] after force token" {
+    export COMMIT_TITLE="[force] ACS-123: trigger downstream CI"
+    export TRIGGER_RELEASE_ON_FORCE="true"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[force][release][skip tests] Update community-repo version to 1.2.3" ]
+}
+
+@test "trigger-release-on-force=true with [force] still sets allow-empty-commit=true" {
+    export COMMIT_TITLE="[force] ACS-123: trigger downstream CI"
+    export TRIGGER_RELEASE_ON_FORCE="true"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output allow-empty-commit)" = "true" ]
+}
+
+@test "trigger-release-on-force=true with versioned [force 26.3.0-A.7] appends [release][skip tests]" {
+    export COMMIT_TITLE="ACS-123 bump [force 26.3.0-A.7]"
+    export TRIGGER_RELEASE_ON_FORCE="true"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[force 26.3.0-A.7][release][skip tests] Update community-repo version to 1.2.3" ]
+}
+
+@test "trigger-release-on-force=true without [force] produces plain message" {
+    export COMMIT_TITLE="ACS-123: regular change"
+    export TRIGGER_RELEASE_ON_FORCE="true"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "Update community-repo version to 1.2.3" ]
+    [ "$(get_output allow-empty-commit)" = "false" ]
+}
+
+@test "trigger-release-on-force=true combined with pending-downstream produces correct message" {
+    export COMMIT_TITLE="[force] ACS-123: trigger downstream CI"
+    export TRIGGER_RELEASE_ON_FORCE="true"
+    export PENDING_DOWNSTREAM="alfresco-enterprise-share"
+    export BRANCH_NAME="master"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    expected="[force][release][skip tests] Update community-repo version to 1.2.3
+
+[skip docker_latest] until alfresco-enterprise-share triggers the build or it is built manually"
+    [ "$(get_output message)" = "$expected" ]
+}
+
+# directives tests
+
+@test "directives empty produces no directives prefix" {
+    export DIRECTIVES=""
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "Update community-repo version to 1.2.3" ]
+}
+
+@test "directives omitted produces no directives prefix" {
+    unset DIRECTIVES
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "Update community-repo version to 1.2.3" ]
+}
+
+@test "directives=[release] without [publish] produces '[release] Update...' message" {
+    export DIRECTIVES="[release]"
+    export VERSION="26.3.0-A.4"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[release] Update community-repo version to 26.3.0-A.4" ]
+}
+
+@test "directives=[release] with [publish] in title produces '[release][publish] Update...' message" {
+    export DIRECTIVES="[release]"
+    export COMMIT_TITLE="ACS-123: release [publish]"
+    export VERSION="26.2.0"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[release][publish] Update community-repo version to 26.2.0" ]
+}
+
+@test "directives=[release] with [publish] at start of title is detected" {
+    export DIRECTIVES="[release]"
+    export COMMIT_TITLE="[publish] ACS-123: release at start"
+    export VERSION="26.2.0"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[release][publish] Update community-repo version to 26.2.0" ]
+}
+
+@test "directives without [publish] in title does not append [publish]" {
+    export DIRECTIVES="[release]"
+    export COMMIT_TITLE="ACS-123: regular release, no publish"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [[ "$(get_output message)" != *"[publish]"* ]]
+}
+
+@test "directives=[release] combined with [force] prefixes force before directives without space" {
+    export DIRECTIVES="[release]"
+    export COMMIT_TITLE="[force] ACS-123: force and release"
+    export VERSION="26.3.0-A.4"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[force][release] Update community-repo version to 26.3.0-A.4" ]
+    [ "$(get_output allow-empty-commit)" = "true" ]
+}
+
+@test "directives=[release] with [publish] combined with [force] produces correct message" {
+    export DIRECTIVES="[release]"
+    export COMMIT_TITLE="[force] ACS-123: force and publish [publish]"
+    export VERSION="26.3.0-A.4"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    [ "$(get_output message)" = "[force][release][publish] Update community-repo version to 26.3.0-A.4" ]
+    [ "$(get_output allow-empty-commit)" = "true" ]
+}
+
+@test "directives=[release] combined with pending-downstream appends skip directive" {
+    export DIRECTIVES="[release]"
+    export VERSION="26.3.0-A.4"
+    export PENDING_DOWNSTREAM="alfresco-enterprise-share"
+    export BRANCH_NAME="feature/ACS-123"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    expected="[release] Update community-repo version to 26.3.0-A.4
+
+[skip docker_release] until alfresco-enterprise-share triggers the build or it is built manually"
+    [ "$(get_output message)" = "$expected" ]
+}
+
+@test "directives=[release] combined with downstream-repo omitted and pending-downstream appends skip directive" {
+    unset DOWNSTREAM_REPO
+    export DIRECTIVES="[release]"
+    export VERSION="26.3.0-A.4"
+    export PENDING_DOWNSTREAM="acs-community-packaging"
+    export BRANCH_NAME="master"
+
+    run bash "$ACTION_SCRIPT"
+
+    [ "$status" -eq 0 ]
+    expected="[release] 26.3.0-A.4
+
+[skip docker_latest] until acs-community-packaging triggers the build or it is built manually"
+    [ "$(get_output message)" = "$expected" ]
+}

.github/workflows/ci.yml

@@ -55,86 +55,6 @@ jobs:
       - name: "Clean Maven cache"
         run: bash ./scripts/ci/cleanup_cache.sh
 
-  veracode_sca:
-    name: "Source Clear Scan (SCA)"
-    runs-on: ubuntu-latest
-    needs: [prepare]
-    if: >
-      (github.ref_name == 'master' || startsWith(github.ref_name, 'release/') || github.event_name == 'pull_request') &&
-      !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force')
-    steps:
-      - uses: actions/checkout@v5
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
-      - name: "Init"
-        run: bash ./scripts/ci/init.sh
-      - uses: Alfresco/alfresco-build-tools/.github/actions/veracode@v8.24.1
-        continue-on-error: true
-        with:
-          srcclr-api-token: ${{ secrets.SRCCLR_API_TOKEN }}
-      - name: "Clean Maven cache"
-        run: bash ./scripts/ci/cleanup_cache.sh
-
-  veracode_sast:
-    name: "Pipeline SAST Scan"
-    runs-on: ubuntu-latest
-    needs: [prepare]
-    if: >
-      (github.ref_name == 'master' || startsWith(github.ref_name, 'release/') || github.event_name == 'pull_request') &&
-      github.actor != 'dependabot[bot]' &&
-      !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force')
-    steps:
-      - uses: actions/checkout@v5
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.24.1
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.24.1
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.24.1
-      - uses: Alfresco/alfresco-build-tools/.github/actions/github-download-file@v8.24.1
-        with:
-          token: ${{ secrets.BOT_GITHUB_TOKEN }}
-          repository: "Alfresco/veracode-baseline-archive"
-          file-path: "alfresco-community-repo/alfresco-community-repo-baseline.json"
-          target: "baseline.json"
-      - name: "Build"
-        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
-        run: |
-          bash ./scripts/ci/init.sh
-          bash ./scripts/ci/build.sh
-      - name: "Remove excluded files"
-        run: |
-          mkdir temp-dir-for-sast
-          bash ./scripts/ci/remove-sast-exclusions.sh ./packaging/war/target/alfresco.war temp-dir-for-sast/reduced.war
-      - name: "Run SAST Scan"
-        uses: veracode/Veracode-pipeline-scan-action@v1.0.20
-        with:
-          vid: ${{ secrets.VERACODE_API_ID }}
-          vkey: ${{ secrets.VERACODE_API_KEY }}
-          file: "temp-dir-for-sast/reduced.war"
-          fail_build: true
-          project_name: alfresco-community-repo
-          issue_details: true
-          veracode_policy_name: Alfresco Default
-          summary_output: true
-          summary_output_file: results.json
-          summary_display: true
-          baseline_file: baseline.json
-          timeout: 15
-      - name: Upload scan result
-        if: success() || failure()
-        run: zip readable_output.zip results.json
-      - name: Upload Artifact
-        if: success() || failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: Veracode Pipeline-Scan Results (Human Readable)
-          path: readable_output.zip
-      - name: "Remove temporary directory"
-        run: rm -rfv temp-dir-for-sast
-      - name: "Clean Maven cache"
-        run: bash ./scripts/ci/cleanup_cache.sh
-
   pmd_scan:
     name: "PMD Scan"
     runs-on: ubuntu-latest
@@ -149,9 +69,9 @@ jobs:
       !contains(github.event.head_commit.message, '[skip tests]') &&
       !contains(github.event.head_commit.message, '[force]')
     steps:
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - uses: Alfresco/ya-pmd-scan@v4.4.1
         with:
           classpath-build-command: "mvn test-compile -ntp -Pags -pl \"-:alfresco-community-repo-docker\""
@@ -181,10 +101,10 @@ jobs:
             testModule: mmt
             testAttributes: "-Dtest=AllMmtUnitTestSuite"
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run tests"
@@ -218,10 +138,10 @@ jobs:
     env:
       REQUIRES_INSTALLED_ARTIFACTS: true
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -253,10 +173,10 @@ jobs:
       matrix:
         version: ['10.5', '10.6']
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: Run MariaDB ${{ matrix.version }} database
@@ -280,10 +200,10 @@ jobs:
       !contains(github.event.head_commit.message, '[skip tests]') &&
       !contains(github.event.head_commit.message, '[force')
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run MariaDB 10.11 database"
@@ -307,10 +227,10 @@ jobs:
       !contains(github.event.head_commit.message, '[skip tests]') &&
       !contains(github.event.head_commit.message, '[force')
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run MySQL 8 database"
@@ -333,10 +253,10 @@ jobs:
       !contains(github.event.head_commit.message, '[skip tests]') &&
       !contains(github.event.head_commit.message, '[force')
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 14.15 database"
@@ -359,10 +279,10 @@ jobs:
             !contains(github.event.head_commit.message, '[skip tests]') &&
             !contains(github.event.head_commit.message, '[force')
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 15.10 database"
@@ -385,11 +305,10 @@ jobs:
       !contains(github.event.head_commit.message, '[skip tests]') &&
       !contains(github.event.head_commit.message, '[force')
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
-
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 16.6 database"
@@ -410,11 +329,10 @@ jobs:
       !contains(github.event.head_commit.message, '[skip tests]') &&
       !contains(github.event.head_commit.message, '[force')
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
-
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run ActiveMQ"
@@ -467,21 +385,28 @@ jobs:
             disabledHostnameVerification: false
             mvn-options: '-Dencryption.ssl.keystore.location=${CI_WORKSPACE}/keystores/alfresco/alfresco.keystore -Dencryption.ssl.truststore.location=${CI_WORKSPACE}/keystores/alfresco/alfresco.truststore'
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
-
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Set transformers tag"
         run: echo "TRANSFORMERS_TAG=$(mvn help:evaluate -Dexpression=dependency.alfresco-transform-core.version -q -DforceStdout)" >> $GITHUB_ENV
       - name: "Set the host IP"
         run: echo "HOST_IP=$(hostname  -I | cut -f1 -d' ')" >> $GITHUB_ENV
+      - name: "Generate GitHub App token"
+        id: app-token
+        if: ${{ matrix.mtls }}
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: read
       - name: "Generate Keystores and Truststores for Mutual TLS configuration"
         if: ${{ matrix.mtls }}
         run: |
-          git clone -b "master" --depth=1 "https://${{ secrets.BOT_GITHUB_USERNAME }}:${{ secrets.BOT_GITHUB_TOKEN }}@github.com/Alfresco/alfresco-ssl-generator.git"
+          git clone -b "master" --depth=1 "https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/Alfresco/alfresco-ssl-generator.git"
           if ${{ matrix.disabledHostnameVerification }} ; then
             bash ${{ env.CI_WORKSPACE }}/alfresco-ssl-generator/scripts/ci/generate_keystores_wrong_hostnames.sh
             echo "HOSTNAME_VERIFICATION_DISABLED=true" >> "$GITHUB_ENV"
@@ -538,10 +463,10 @@ jobs:
     env:
       REQUIRES_LOCAL_IMAGES: true
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -577,10 +502,10 @@ jobs:
       !contains(github.event.head_commit.message, '[skip tests]') &&
       !contains(github.event.head_commit.message, '[force')
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run Postgres 16.6 database"
@@ -607,10 +532,10 @@ jobs:
     env:
       REQUIRES_INSTALLED_ARTIFACTS: true
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -639,10 +564,10 @@ jobs:
     env:
       REQUIRES_INSTALLED_ARTIFACTS: true
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -667,10 +592,10 @@ jobs:
     env:
       REQUIRES_LOCAL_IMAGES: true
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -713,10 +638,10 @@ jobs:
       !contains(github.event.head_commit.message, '[skip tests]') &&
       !contains(github.event.head_commit.message, '[force]')
     steps:
-      - uses: actions/checkout@v7
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |

.github/workflows/dependency-graph.yml

@@ -25,7 +25,7 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/maven-dependency-scan@v18.11.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/maven-dependency-scan@v18.20.0
         with:
           java-version: '21'
           maven-version: '3.9.9'

.github/workflows/master_release.yml

@@ -1,7 +1,7 @@
 name: Master/Release branch workflow
 
 # Read-only is enough for the default GITHUB_TOKEN: the release/downstream jobs
-# push using the bot PAT (BOT_GITHUB_TOKEN), not the workflow token.
+# push using a GitHub App installation token, not the workflow token.
 permissions:
   contents: read
 
@@ -12,9 +12,6 @@ on:
       - release/**
 
 env:
-  GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
-  GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
-  GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
   DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
   DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
   MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
@@ -24,6 +21,20 @@ env:
   GITHUB_ACTIONS_DEPLOY_TIMEOUT: 60
 
 jobs:
+  commit_parser:
+    name: "Parse commit metadata"
+    runs-on: ubuntu-latest
+    outputs:
+      title: ${{ steps.get-commit.outputs.COMMIT_MESSAGE }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 2
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-commit-message@v18.20.0
+        id: get-commit
+        with:
+          header-only: "true"
+
   run_ci:
     # The reusable CI workflow contains the pmd_scan job which needs security-events: write
     # to upload SARIF; the caller must grant it for the nested job to be allowed.
@@ -35,57 +46,96 @@ jobs:
   push_to_nexus:
     name: "Push to Nexus"
     runs-on: ubuntu-latest
-    needs: [run_ci]
+    needs: [run_ci, commit_parser]
     if: >
       !(failure() || cancelled()) &&
-      !contains(github.event.head_commit.message, '[no release]') &&
+      !contains(needs.commit_parser.outputs.title, '[no release]') &&
       github.event_name != 'pull_request'
     steps:
-      - uses: actions/checkout@v7
+      - name: "Generate GitHub App token"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          persist-credentials: false
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: write
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+      - name: "Create local release branch"
+        run: git checkout -B "${{ github.ref_name }}"
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
-      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v18.11.0
-        with:
-          username: ${{ env.GIT_USERNAME }}
-          email: ${{ env.GIT_EMAIL }}
-          global: true
+      - name: "Compute release and next development versions"
+        id: versions
+        uses: Alfresco/alfresco-build-tools/.github/actions/maven-compute-release-versions@v18.20.0
+      - name: "Verify release version"
+        run: bash scripts/ci/verify_release_tag.sh
       - name: "Release"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
-        run: |
-          bash scripts/ci/verify_release_tag.sh
-          bash scripts/ci/maven_release.sh
+        uses: Alfresco/alfresco-build-tools/.github/actions/maven-release-slim@v18.20.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          release-version: ${{ steps.versions.outputs.release-version }}
+          development-version: ${{ steps.versions.outputs.next-development-version }}
+          release-profile: "all-tas-tests,ags"
+          maven-args: "-DskipTests -Dbuild-number=${{ env.BUILD_NUMBER }}"
       - name: "Clean Maven cache"
         run: bash ./scripts/ci/cleanup_cache.sh
+
   update_downstream:
     name: "Update alfresco-enterprise-repo"
     runs-on: ubuntu-latest
-    needs: [push_to_nexus]
+    needs: [push_to_nexus, commit_parser]
     if: >
       !(failure() || cancelled()) &&
-      !contains(github.event.head_commit.message, '[no downstream]') &&
+      !contains(needs.commit_parser.outputs.title, '[no downstream]') &&
       github.event_name != 'pull_request'
     steps:
-      - uses: actions/checkout@v7
+      - name: "Generate GitHub App token"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          persist-credentials: false
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.11.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.11.0
+          owner: Alfresco
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: write
+          repositories: |
+            alfresco-community-repo
+            alfresco-enterprise-repo
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.20.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.20.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
-      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v18.11.0
-        with:
-          username: ${{ env.GIT_USERNAME }}
-          email: ${{ env.GIT_EMAIL }}
-          global: true
       - name: "Update downstream"
+        id: update-downstream
         run: bash ./scripts/ci/update_downstream.sh
         env:
-          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+      - name: "Compute downstream commit message"
+        id: commit-meta
+        uses: ./.github/actions/get-downstream-commit-message
+        with:
+          commit-title: ${{ needs.commit_parser.outputs.title }}
+          version: ${{ steps.update-downstream.outputs.version }}
+          downstream-repo: community-repo
+      - name: "Commit downstream version update"
+        uses: iarekylew00t/verified-bot-commit@33985d44b7719dcaf0b854a0f4b0caad9bdc5b86 # v2.3.3
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          repository: Alfresco/alfresco-enterprise-repo
+          ref: ${{ github.ref_name }}
+          workspace: ${{ github.workspace }}/../alfresco-enterprise-repo
+          files: pom.xml
+          message: ${{ steps.commit-meta.outputs.message }}
+          allow-empty-commit: ${{ steps.commit-meta.outputs.allow-empty-commit }}
+          if-no-commit: info
       - name: "Clean Maven cache"
         run: bash ./scripts/ci/cleanup_cache.sh

.github/workflows/precommit_formatter.yml

@@ -13,13 +13,21 @@ jobs:
   format-code:
     name: "Reformat code"
     runs-on: ubuntu-latest
-    # Commits the reformatted code and pushes it back using the default GITHUB_TOKEN.
     permissions:
       contents: write
     if: contains(github.event.head_commit.message, '[reformat code]')
     steps:
-      - uses: actions/checkout@v7
-      - name: Set up Python ${{ inputs.python-version }}
+      - name: "Generate GitHub App token"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: write
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+      - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.9"
@@ -29,11 +37,11 @@ jobs:
           extra_args: --all-files
       - name: Update secrets baseline
         run: pip install detect-secrets && detect-secrets scan --baseline .secrets.baseline
-      - uses: Alfresco/alfresco-build-tools/.github/actions/git-commit-changes@v18.11.0
+      - uses: iarekylew00t/verified-bot-commit@33985d44b7719dcaf0b854a0f4b0caad9bdc5b86 # v2.3.3
         with:
-          username: ${{ secrets.BOT_GITHUB_USERNAME }}
-          add-options: -u
-          commit-message: "Apply Pre-Commit code formatting"
-          skip-if-no-changes: true
-      - name: Push changes
-        run: git push
+          token: ${{ steps.app-token.outputs.token }}
+          files: |
+            **/*.java
+            .secrets.baseline
+          message: "Apply Pre-Commit code formatting"
+          if-no-commit: info

.github/workflows/scheduled_release_trigger.yml

@@ -0,0 +1,42 @@
+name: Scheduled release trigger
+
+# Triggers a release on master every Sunday at midnight by creating an empty
+# [force] commit, which causes master_release.yml to run the release job.
+
+permissions:
+  contents: read
+
+on:
+  schedule:
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+
+jobs:
+  trigger-release:
+    name: "Create force-release commit"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Generate GitHub App token"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: write
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          ref: master
+
+      - name: "Compute release date"
+        id: date
+        run: echo "value=$(date --iso-8601)" >> "$GITHUB_OUTPUT"
+
+      - name: "Create empty force-release commit"
+        uses: iarekylew00t/verified-bot-commit@33985d44b7719dcaf0b854a0f4b0caad9bdc5b86 # v2.3.3
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          message: "[force] Force release for ${{ steps.date.outputs.value }}"
+          allow-empty-commit: true
+          if-no-commit: error

.github/workflows/test-with-bats.yml

@@ -0,0 +1,35 @@
+name: CI with BATS 🦇
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - '.github/actions/**'
+  pull_request:
+    branches: [ master ]
+    paths:
+      - '.github/actions/**'
+
+jobs:
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    steps:
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup Bats and bats libs
+        id: setup-bats
+        uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # v4.0.0
+        with:
+          bats-version: 1.13.0
+
+      - name: 🦇🦇🦇
+        shell: bash
+        env:
+          BATS_LIB_PATH: ${{ steps.setup-bats.outputs.lib-path }}
+          TERM: xterm
+        run: bats -r --print-output-on-failure --formatter pretty .

.secrets.baseline

@@ -133,7 +133,7 @@
         "filename": ".github/workflows/master_release.yml",
         "hashed_secret": "3e26d6750975d678acb8fa35a0f69237881576b0",
         "is_verified": false,
-        "line_number": 34,
+        "line_number": 45,
         "is_secret": false
       }
     ],
@@ -1845,5 +1845,5 @@
       }
     ]
   },
-  "generated_at": "2026-06-24T09:18:42Z"
+  "generated_at": "2026-08-21T09:10:13Z"
 }

scripts/ci/build_functions.sh

@@ -20,7 +20,9 @@ function cloneRepo() {
 
   rm -rf "$(basename "${REPO%.git}")"
 
-  git clone -b "${TAG_OR_BRANCH}" --depth=1 "https://${GIT_USERNAME}:${GIT_PASSWORD}@${REPO}"
+  { set +x; } 2>/dev/null
+  git clone -b "${TAG_OR_BRANCH}" --depth=1 "https://x-access-token:${APP_TOKEN}@${REPO}"
+  { set -x; } 2>/dev/null
 
   popd >/dev/null
 }
@@ -76,7 +78,9 @@ function remoteBranchExists() {
   local REMOTE_REPO="${1}"
   local BRANCH="${2}"
 
-  git ls-remote --exit-code --heads "https://${GIT_USERNAME}:${GIT_PASSWORD}@${REMOTE_REPO}" "${BRANCH}" &>/dev/null
+  { set +x; } 2>/dev/null
+  git ls-remote --exit-code --heads "https://x-access-token:${APP_TOKEN}@${REMOTE_REPO}" "${BRANCH}" &>/dev/null
+  { set -x; } 2>/dev/null
 }
 
 function identifyUpstreamSourceBranch() {
@@ -175,7 +179,9 @@ function retieveLatestTag() {
 
   local LOCAL_PATH="/tmp/$(basename "${REPO%.git}")"
 
-  git clone -q -b "${BRANCH}" "https://${GIT_USERNAME}:${GIT_PASSWORD}@${REPO}" "${LOCAL_PATH}"
+  { set +x; } 2>/dev/null
+  git clone -q -b "${BRANCH}" "https://x-access-token:${APP_TOKEN}@${REPO}" "${LOCAL_PATH}"
+  { set -x; } 2>/dev/null
 
   pushd "${LOCAL_PATH}" >/dev/null
   git describe --abbrev=0 --tags
@@ -184,4 +190,4 @@ function retieveLatestTag() {
   rm -rf "${LOCAL_PATH}"
 }
 
-set -vx
+set -vx

scripts/ci/maven_release.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-echo "=========================== Starting Release Script ==========================="
-PS4="\[\e[35m\]+ \[\e[m\]"
-set -vex
-pushd "$(dirname "${BASH_SOURCE[0]}")/../../"
-
-# Use full history for release
-git checkout -B "${BRANCH_NAME}"
-
-# Run the release plugin - with "[skip ci]" in the release commit message
-mvn -B \
-  -Pall-tas-tests \
-  -Pags \
-  "-Darguments=-Pall-tas-tests -Pags -DskipTests -Dbuild-number=${BUILD_NUMBER}" \
-  release:clean release:prepare release:perform \
-  -DscmCommentPrefix="[maven-release-plugin][skip ci] " \
-  -Dusername="${GIT_USERNAME}" \
-  -Dpassword="${GIT_PASSWORD}"
-
-popd
-set +vex
-echo "=========================== Finishing Release Script =========================="
-

scripts/ci/update_downstream.sh

@@ -28,25 +28,8 @@ mvn -B versions:set-property versions:commit \
   -Dproperty=dependency.alfresco-community-repo.version \
   "-DnewVersion=${VERSION}"
 
-# Commit changes
-git status
-git --no-pager diff pom.xml
-git add pom.xml
-
-if [[ "${COMMIT_MESSAGE}" =~ \[force[^\]]*\] ]]; then
-  FORCE_TOKEN=$(echo "${COMMIT_MESSAGE}" | sed "s|^.*\(\[force[^]]*\]\).*$|\1|g")
-  git commit --allow-empty -m "${FORCE_TOKEN} Update community-repo version to ${VERSION}"
-  git push
-elif git status --untracked-files=no --porcelain | grep -q '^' ; then
-  git commit -m "Update community-repo version to ${VERSION}"
-  git push
-else
-  echo "Dependencies are already up to date."
-  git status
-fi
-
+echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
 
 popd
 set +vex
 echo "=========================== Finishing Update Downstream Script =========================="
-