Release 8.0.3 - Fix PNG signature images in PDF viewer

2026-09-02 17:53:30 +00:00 · 2026-09-01 09:55:47 +02:00
parent 8efbce65fc
commit 375502d803
7 changed files with 333 additions and 128 deletions
@@ -9,18 +9,17 @@ inputs:
 runs:
  using: "composite"
  steps:
-    - name: Before install
-      if: ${{ ! env.ACT }}
-      shell: bash
-      run: |
-        pip install --user --quiet awscli
-
    - name: base vars
      shell: bash
      run: |
+        if [ -n "${GITHUB_BASE_REF:-}" ]; then
+          BASE_HASH=$(git merge-base "origin/${GITHUB_BASE_REF}" HEAD 2>/dev/null || git rev-parse HEAD)
+        else
+          BASE_HASH=$(git rev-parse HEAD)
+        fi
        {
          echo "GIT_HASH=$(git rev-parse HEAD)";
-          echo "BASE_HASH=$(git merge-base origin/${GITHUB_BASE_REF} HEAD)";
+          echo "BASE_HASH=${BASE_HASH}";
          echo "HEAD_HASH=HEAD";
          echo "HEAD_COMMIT_HASH=${GH_COMMIT}";
          echo "NX_CALCULATION_FLAGS=--all";
@@ -31,10 +30,22 @@ runs:

    - name: affected:* flag parser
      shell: bash
-      if: ${{ contains(github.event.head_commit.message , '[affected:*]') }}
+      env:
+        EVENT_NAME: ${{ github.event_name }}
+        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
      run: |
-        echo "Setting up CI to run with commit flag [affected:*] flag."
-        echo "BREAK_ACTION=true" >> $GITHUB_ENV
+        # Get commit message safely from git to avoid script injection
+        # For PRs, use the PR head SHA; for other events use HEAD
+        if [ "$EVENT_NAME" == "pull_request" ] && [ -n "$PR_HEAD_SHA" ]; then
+          COMMIT_MSG=$(git log -1 --format=%B "$PR_HEAD_SHA" 2>/dev/null || echo "")
+        else
+          COMMIT_MSG=$(git log -1 --format=%B 2>/dev/null || echo "")
+        fi
+
+        if echo "$COMMIT_MSG" | grep -qF "[affected:*]"; then
+          echo "Setting up CI to run with commit flag [affected:*] flag."
+          echo "BREAK_ACTION=true" >> $GITHUB_ENV
+        fi

    - name: PULL_REQUEST event
      if: ${{ env.BREAK_ACTION == false && github.event_name == 'pull_request' && !github.event.pull_request.merged }}
@@ -49,13 +60,15 @@ runs:
        } >> $GITHUB_ENV

    - name: RELEASE on master/develop patch branch
-      if: ${{ env.BREAK_ACTION == false && github.event.pull_request.merged }}
+      if: ${{ env.BREAK_ACTION == false && (github.event.pull_request.merged || github.event_name == 'push') }}
      shell: bash
+      env:
+        REF_NAME: ${{ github.ref_name }}
      run: |
-        if [[ "${{ github.ref_name }}" =~ ^master(-patch.*)?$ ]]; then
+        if [[ "$REF_NAME" =~ ^master(-patch.*)?$ ]]; then
            # into master(-patch*)
            echo "Setting up CI flags for Push on master patch"
-        elif [[ "${{ github.ref_name }}" =~ ^develop-patch.*$ ]]; then
+        elif [[ "$REF_NAME" =~ ^develop-patch.*$ ]]; then
            # into develop-patch*
            echo "Setting up CI flags for Push develop patch"
        else
@@ -12,7 +12,7 @@ inputs:
 runs:
  using: 'composite'
  steps:
-    - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+    - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
      name: Create git tag
      env:
        TAG_NAME: ${{ inputs.tagName }}
@@ -2,36 +2,44 @@ name: "set npm tag"
 description: "se NPM tag"

 inputs:
-  event_name:
-    description: "override github.event_name"
-    required: false
-    default: ${{ github.event_name }}
  branch_name:
    description: "override GITHUB_REF_NAME"
    required: false
-    default: $GITHUB_REF_NAME
+    default: ${{ github.ref_name }}
+
+outputs:
+  npm-tag:
+    description: "NPM tag"
+    value: ${{ steps.set-npm-tag.outputs.npm-tag }}

 runs:
  using: "composite"
  steps:

    - name: set TAG_NPM
+      id: set-npm-tag
      shell: bash
+      env:
+        BRANCH_NAME: ${{ inputs.branch_name }}
      run: |
-        TAG_NPM="alpha"
-        VERSION_IN_PACKAGE_JSON=$(node -p "require('./package.json')".version)
-        echo "version in package.json=${VERSION_IN_PACKAGE_JSON}"
-        if [[ ${{ inputs.branch_name }} =~ ^master(-patch.*)?$ ]]; then
-            # Pre-release versions
-            if [[ $VERSION_IN_PACKAGE_JSON =~ ^[0-9]*\.[0-9]*\.[0-9]*-A\.[0-9]*$ ]];
-            then
-                TAG_NPM=next
-            # Stable major versions
-            else
-                TAG_NPM=latest
-            fi
+        if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            TAG_NPM="branch"
+        else
+          TAG_NPM="alpha"
+          VERSION_IN_PACKAGE_JSON=$(node -p "require('./package.json')".version)
+          echo "version in package.json=${VERSION_IN_PACKAGE_JSON}"
+          if [[ $BRANCH_NAME =~ ^master(-patch.*)?$ ]]; then
+              # Pre-release versions
+              if [[ $VERSION_IN_PACKAGE_JSON =~ ^[0-9]*\.[0-9]*\.[0-9]*-A\.[0-9]*$ ]]; then
+                  TAG_NPM=next
+              # Stable major versions
+              else
+                  TAG_NPM=latest
+              fi
+          fi
+          if [[ $BRANCH_NAME =~ ^develop(-patch.*)?$ ]]; then
+              TAG_NPM=alpha
+          fi
        fi
-        if [[ ${{ inputs.branch_name }} =~ ^develop(-patch.*)?$ ]]; then
-            TAG_NPM=alpha
-        fi
-        echo "TAG_NPM=${TAG_NPM}" >> $GITHUB_ENV
+        echo "npm-tag=$TAG_NPM" >> $GITHUB_OUTPUT
+        echo "Computed tag: $TAG_NPM"
@@ -1,13 +1,12 @@
 name: 'Setup'
 description: 'Initialize cache, env var load'
 inputs:
-  enable-cache:
-    description: 'enable caching'
+  cache-suffix:
+    description: 'Suffix to make Nx cache key unique per job (e.g. matrix project name)'
    required: false
-    type: boolean
-    default: 'true'
-  enable-node-modules-cache:
-    description: 'enable caching for node modules'
+    default: 'default'
+  full-setup:
+    description: 'Run git-latest-tag, npm-tag, and before-install (requires fetch-depth: 0). Set to false for matrix jobs that only need node/cache.'
    required: false
    type: boolean
    default: 'true'
@@ -16,43 +15,50 @@ inputs:
    required: false
    type: boolean
    default: 'false'
+outputs:
+  npm-tag:
+    description: 'NPM tag'
+    value: ${{ steps.set-npm-tag.outputs.npm-tag }}
 runs:
  using: "composite"
  steps:
-      - name: install NPM
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - name: Set consistent machine ID for Nx cache
+        shell: bash
+        run: echo "nx-github-actions" | sudo tee /etc/machine-id > /dev/null
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: '.nvmrc'
-          cache-dependency-path: package-lock.json
+          cache: 'pnpm'
      - name: get latest tag sha
+        if: ${{ inputs.full-setup == 'true' }}
        id: tag-sha
-        uses: Alfresco/alfresco-build-tools/.github/actions/git-latest-tag@691c1d16c90c88a92d2438a001acdefc0efa7d2a # v8.26.0
-# CACHE
-      - name: Node Modules cache
-        id: node-modules-cache
-        if: ${{ inputs.enable-node-modules-cache == 'true' }}
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
-        env:
-          cache-name: node-modules-cache
+        uses: Alfresco/alfresco-build-tools/.github/actions/git-latest-tag@98bcfbe06aafffdc0e9a790f352602316f82303b # v18.23.0
+      - name: load "NPM TAG"
+        if: ${{ inputs.full-setup == 'true' }}
+        id: set-npm-tag
+        uses: ./.github/actions/set-npm-tag
+      - name: Install dependencies
+        shell: bash
+        run: pnpm install --frozen-lockfile
+      - name: Security audit
+        shell: bash
+        run: pnpm audit --audit-level=critical
+      - name: Restore nx cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
-            node_modules
-          key: .npm-${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
+            nxcache
+            .nx
+            dist
+          key: ${{ runner.os }}-nxcache-${{ inputs.cache-suffix }}-${{ hashFiles('nx.json') }}-${{ github.sha }}
          restore-keys: |
-            node_modules-${{ runner.os }}-build-${{ env.cache-name }}-
-            node_modules-${{ runner.os }}-build-
-            node_modules-${{ runner.os }}-
-      - name: pip cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
-        if: ${{ inputs.enable-cache == 'true' }}
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-
-          restore-keys: |
-            ${{ runner.os }}
-      - name: load "NPM TAG"
-        uses: ./.github/actions/set-npm-tag
+            ${{ runner.os }}-nxcache-${{ inputs.cache-suffix }}-${{ hashFiles('nx.json') }}-
+            ${{ runner.os }}-nxcache-${{ inputs.cache-suffix }}-
      - name: before install script
+        if: ${{ inputs.full-setup == 'true' }}
        uses: ./.github/actions/before-install
        with:
          act: ${{ inputs.act }}
@@ -0,0 +1,134 @@
+name: Release lib on branch
+run-name: Release lib on branch ${{ github.ref_name }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry-run-flag:
+        description: 'enable dry-run on artifact push'
+        required: false
+        type: boolean
+        default: true
+      npm-tag:
+        description: 'NPM tag to use for publishing'
+        required: false
+        type: string
+        default: 'branch'
+
+env:
+  BASE_REF: ${{ github.base_ref }}
+  HEAD_REF: ${{ github.head_ref }}
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  GITHUB_BRANCH: ${{ github.ref_name }}
+  GH_BUILD_DIR: ${{ github.workspace }}
+  GH_COMMIT: ${{ github.sha }}
+  BUILD_ID: ${{ github.run_id }}
+  GH_RUN_NUMBER: ${{ github.run_attempt }}
+  GH_BUILD_NUMBER: ${{ github.run_id }}
+  JOB_ID: ${{ github.run_id }}
+  LOG_LEVEL: "ERROR"
+  S3_BUILD_BUCKET_SHORT_NAME: ${{ secrets.S3_BUILD_BUCKET_SHORT_NAME }}
+  NODE_OPTIONS: "--max-old-space-size=5120"
+  DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
+  DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_REPOSITORY_USER }}
+  DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_REPOSITORY_PASSWORD }}
+  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
+  GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
+  REPO_OWNER: "Alfresco"
+  REPO_NAME: "alfresco-ng2-components"
+  STORYBOOK_DIR: "./dist/storybook/stories"
+  BUILT_LIBS_DIR: "./dist/libs"
+  NODE_MODULES_DIR: "./node_modules"
+  REDIRECT_URI: /
+
+jobs:
+  setup:
+    timeout-minutes: 20
+    name: "Setup"
+    runs-on: ubuntu-latest
+    steps:
+      - name: set TAG_NPM BRANCH
+        shell: bash
+        run: |
+          TAG_NPM=${{ inputs.npm-tag }}
+          echo "Set TAG with name: ${TAG_NPM}"
+          echo "TAG_NPM=${TAG_NPM}" >> $GITHUB_ENV
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup
+        with:
+          enable-cache: false
+          enable-node-modules-cache: false
+      - name: install
+        run: |
+          npm ci
+          npx nx run js-api:bundle
+          npx nx run cli:bundle
+      - uses: ./.github/actions/upload-node-modules-and-artifacts
+
+  release-npm:
+    needs: [setup]
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup
+        with:
+          enable-cache: false
+          enable-node-modules-cache: false
+      - id: set-dryrun
+        uses: ./.github/actions/enable-dryrun
+        with:
+          dry-run-flag: ${{ inputs.dry-run-flag }}
+      - uses: ./.github/actions/download-node-modules-and-artifacts
+      - name: Set libraries versions
+        if: ${{ inputs.npm-tag == 'branch' }}
+        run: |
+          set -u;
+          ./scripts/update-version.sh -gnu || exit 1;
+      - name: Set migrations
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const setMigrations = require('./scripts/github/release/set-migrations.js');
+            setMigrations();
+      - name: Build libraries
+        run: |
+          npx nx run-many --target=build --prod --skip-nx-cache
+          npx nx run-many --target=build-schematics
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        name: release libraries GH registry
+        with:
+          node-version-file: '.nvmrc'
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@alfresco'
+      - run: npx nx run-many --target=npm-publish --tag=branch|| exit 1
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        name: release libraries Npm registry
+        with:
+          node-version-file: '.nvmrc'
+          registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
+          scope: '@alfresco'
+      - run: npx nx run-many --target=npm-publish --tag=branch || exit 1
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
+
+  npm-check-bundle:
+    needs: [release-npm]
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/npm-check-bundle
@@ -1,5 +1,4 @@
-name: Release lib on branch
-run-name: Release lib on branch ${{ github.ref_name }}
+name: "release"

 on:
  workflow_dispatch:
@@ -9,126 +8,171 @@ on:
        required: false
        type: boolean
        default: true
-      npm-tag:
-        description: 'NPM tag to use for publishing'
-        required: false
-        type: string
-        default: 'branch'
+  push:
+    branches:
+      - develop
+      - develop-patch*
+      - master
+      - master-patch-*
+
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false

 env:
-  BASE_REF: ${{ github.base_ref }}
-  HEAD_REF: ${{ github.head_ref }}
-  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-  GITHUB_BRANCH: ${{ github.ref_name }}
-  GH_BUILD_DIR: ${{ github.workspace }}
  GH_COMMIT: ${{ github.sha }}
-  BUILD_ID: ${{ github.run_id }}
-  GH_RUN_NUMBER: ${{ github.run_attempt }}
  GH_BUILD_NUMBER: ${{ github.run_id }}
-  JOB_ID: ${{ github.run_id }}
  LOG_LEVEL: "ERROR"
-  S3_BUILD_BUCKET_SHORT_NAME: ${{ secrets.S3_BUILD_BUCKET_SHORT_NAME }}
  NODE_OPTIONS: "--max-old-space-size=5120"
-  DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
-  DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_REPOSITORY_USER }}
-  DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_REPOSITORY_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
-  GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
-  REPO_OWNER: "Alfresco"
-  REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
-  BUILT_LIBS_DIR: "./dist/libs"
-  NODE_MODULES_DIR: "./node_modules"
-  REDIRECT_URI: /

 jobs:
  setup:
    timeout-minutes: 20
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    name: "Setup"
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
    steps:
-      - name: set TAG_NPM BRANCH
-        shell: bash
-        run: |
-          TAG_NPM=${{ inputs.npm-tag }}
-          echo "Set TAG with name: ${TAG_NPM}"
-          echo "TAG_NPM=${TAG_NPM}" >> $GITHUB_ENV
      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: ./.github/actions/setup
-        with:
-          enable-cache: false
-          enable-node-modules-cache: false
      - name: install
        run: |
-          npm ci
-          npx nx run js-api:bundle
-          npx nx run cli:bundle
+          pnpm install --frozen-lockfile
+          pnpm bundle:js-api
+          pnpm bundle:cli
      - uses: ./.github/actions/upload-node-modules-and-artifacts

  release-npm:
    needs: [setup]
+    outputs:
+      release_version: ${{ steps.set-version.outputs.release_version }}
    timeout-minutes: 30
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
+      id-token: write  # Required for OIDC
      contents: read
      packages: write
+      actions: read
    steps:
      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
-      - uses: ./.github/actions/setup
-        with:
-          enable-cache: false
-          enable-node-modules-cache: false
+      - id: setup
+        uses: ./.github/actions/setup
      - id: set-dryrun
        uses: ./.github/actions/enable-dryrun
        with:
          dry-run-flag: ${{ inputs.dry-run-flag }}
      - uses: ./.github/actions/download-node-modules-and-artifacts
      - name: Set libraries versions
-        if: ${{ inputs.npm-tag == 'branch' }}
+        id: set-version
        run: |
          set -u;
-          ./scripts/update-version.sh -gnu || exit 1;
+          ./scripts/github/build/bumpversion.sh
      - name: Set migrations
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const setMigrations = require('./scripts/github/release/set-migrations.js');
            setMigrations();
-      - name: Build libraries
+      - name: build libraries
        run: |
-          npx nx run-many --target=build --prod --skip-nx-cache
-          npx nx run-many --target=build-schematics
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+          pnpm build:libs
+          pnpm build:schematics
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        name: release libraries GH registry
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://npm.pkg.github.com'
          scope: '@alfresco'
-      - run: npx nx run-many --target=npm-publish --tag=branch|| exit 1
+      - run: pnpm run publish --tag ${{ steps.setup.outputs.npm-tag }} --provenance=false ${{ steps.set-dryrun.outputs.dryrun }}
        env:
-          NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        name: release libraries Npm registry
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
          scope: '@alfresco'
-      - run: npx nx run-many --target=npm-publish --tag=branch || exit 1
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
+      - run: pnpm run publish --tag ${{ steps.setup.outputs.npm-tag }} ${{ steps.set-dryrun.outputs.dryrun }}
+
+  create-git-tag:
+    runs-on: ubuntu-latest
+    needs: [setup, release-npm]
+    if: github.event_name != 'workflow_dispatch'
+    name: Create github tag
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+      - uses: './.github/actions/create-git-tag'
+        with:
+          tagName: ${{ needs.release-npm.outputs.release_version }}

  npm-check-bundle:
    needs: [release-npm]
    timeout-minutes: 15
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./.github/actions/npm-check-bundle
+
+  push-translation-keys-to-crowdin:
+    name: Push translations keys to Crowdin
+    if: github.ref_name == 'develop' && github.event_name != 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    needs: [setup]
+    permissions:
+      contents: read
+      packages: read
+      actions: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Push Source Files to Crowdin
+        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
+        with:
+          upload_sources: true
+          upload_sources_args: --delete-obsolete
+        env:
+          CROWDIN_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}
+
+  pull-translation-keys-from-crowdin:
+    needs: push-translation-keys-to-crowdin
+    name: Run Crowdin pull pipeline for up-to-date sync
+    uses: ./.github/workflows/pull-from-crowdin.yml
+    secrets:
+      GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+      CROWDIN_TRANSLATIONS_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}
+      HXPS_GIT_COMMIT_SIGNING_PRIVATE_KEY: ${{ secrets.HXPS_GIT_COMMIT_SIGNING_PRIVATE_KEY }}
+
+  finalize:
+    if: always()
+    runs-on: ubuntu-latest
+    name: Final Results
+    needs: [release-npm, npm-check-bundle]
+    steps:
+      - name: Check job execution status
+        if: >-
+          ${{
+              contains(needs.*.result, 'failure')
+            || contains(needs.*.result, 'cancelled')
+          }}
+        run: exit 1
@@ -1,7 +1,7 @@
 {
  "name": "alfresco-ng2-components",
  "description": "Alfresco Angular components",
-  "version": "8.0.2",
+  "version": "8.0.3-A.1",
  "author": "Hyland Software, Inc. and its affiliates",
  "scripts": {
    "prepare": "husky install",