ACS-12079 Migrate to verified commits and GitHub App tokens (#4221)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

scripts/ci/build_functions.sh

@@ -20,7 +20,9 @@ function cloneRepo() {
 
   rm -rf "$(basename "${REPO%.git}")"
 
-  git clone -b "${TAG_OR_BRANCH}" --depth=1 "https://${GIT_USERNAME}:${GIT_PASSWORD}@${REPO}"
+  { set +x; } 2>/dev/null
+  git clone -b "${TAG_OR_BRANCH}" --depth=1 "https://x-access-token:${APP_TOKEN}@${REPO}"
+  { set -x; } 2>/dev/null
 
   popd >/dev/null
 }
@@ -76,7 +78,9 @@ function remoteBranchExists() {
   local REMOTE_REPO="${1}"
   local BRANCH="${2}"
 
-  git ls-remote --exit-code --heads "https://${GIT_USERNAME}:${GIT_PASSWORD}@${REMOTE_REPO}" "${BRANCH}" &>/dev/null
+  { set +x; } 2>/dev/null
+  git ls-remote --exit-code --heads "https://x-access-token:${APP_TOKEN}@${REMOTE_REPO}" "${BRANCH}" &>/dev/null
+  { set -x; } 2>/dev/null
 }
 
 function identifyUpstreamSourceBranch() {
@@ -175,7 +179,9 @@ function retieveLatestTag() {
 
   local LOCAL_PATH="/tmp/$(basename "${REPO%.git}")"
 
-  git clone -q -b "${BRANCH}" "https://${GIT_USERNAME}:${GIT_PASSWORD}@${REPO}" "${LOCAL_PATH}"
+  { set +x; } 2>/dev/null
+  git clone -q -b "${BRANCH}" "https://x-access-token:${APP_TOKEN}@${REPO}" "${LOCAL_PATH}"
+  { set -x; } 2>/dev/null
 
   pushd "${LOCAL_PATH}" >/dev/null
   git describe --abbrev=0 --tags
@@ -184,4 +190,4 @@ function retieveLatestTag() {
   rm -rf "${LOCAL_PATH}"
 }
 
-set -vx
+set -vx

scripts/ci/maven_release.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-echo "=========================== Starting Release Script ==========================="
-PS4="\[\e[35m\]+ \[\e[m\]"
-set -vex
-pushd "$(dirname "${BASH_SOURCE[0]}")/../../"
-
-# Use full history for release
-git checkout -B "${BRANCH_NAME}"
-
-# Run the release plugin - with "[skip ci]" in the release commit message
-mvn -B \
-  -Pall-tas-tests \
-  -Pags \
-  "-Darguments=-Pall-tas-tests -Pags -DskipTests -Dbuild-number=${BUILD_NUMBER}" \
-  release:clean release:prepare release:perform \
-  -DscmCommentPrefix="[maven-release-plugin][skip ci] " \
-  -Dusername="${GIT_USERNAME}" \
-  -Dpassword="${GIT_PASSWORD}"
-
-popd
-set +vex
-echo "=========================== Finishing Release Script =========================="
-

scripts/ci/update_downstream.sh

@@ -28,25 +28,8 @@ mvn -B versions:set-property versions:commit \
   -Dproperty=dependency.alfresco-community-repo.version \
   "-DnewVersion=${VERSION}"
 
-# Commit changes
-git status
-git --no-pager diff pom.xml
-git add pom.xml
-
-if [[ "${COMMIT_MESSAGE}" =~ \[force[^\]]*\] ]]; then
-  FORCE_TOKEN=$(echo "${COMMIT_MESSAGE}" | sed "s|^.*\(\[force[^]]*\]\).*$|\1|g")
-  git commit --allow-empty -m "${FORCE_TOKEN} Update community-repo version to ${VERSION}"
-  git push
-elif git status --untracked-files=no --porcelain | grep -q '^' ; then
-  git commit -m "Update community-repo version to ${VERSION}"
-  git push
-else
-  echo "Dependencies are already up to date."
-  git status
-fi
-
+echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
 
 popd
 set +vex
 echo "=========================== Finishing Update Downstream Script =========================="
-