From fe2b3d85dd203a99c2e41532bddf4f02da9f60df Mon Sep 17 00:00:00 2001
From: Michal Kinas <113341662+MichalKinas@users.noreply.github.com>
Date: Thu, 9 Jul 2026 15:05:58 +0200
Subject: [PATCH] [ACS-12108] Introduce signed commits into ADF workflows
 (#12040)

---
 .github/workflows/package_dispatch.yml  | 11 ++++++++++-
 .github/workflows/pull-from-crowdin.yml | 14 +++++++++++---
 .github/workflows/release.yml           |  2 +-
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/package_dispatch.yml b/.github/workflows/package_dispatch.yml
index b2be64962c..398bfe5737 100644
--- a/.github/workflows/package_dispatch.yml
+++ b/.github/workflows/package_dispatch.yml
@@ -8,13 +8,22 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.registry_package.package_type == 'npm' && github.event.registry_package.name == 'adf-core'
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: alfresco-apps
+          permission-contents: write
       - name: Dispatch event to monorepo
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PACKAGE_NAME: ${{ github.event.registry_package.name }}
           PACKAGE_VERSION: ${{ github.event.registry_package.package_version.name }}
         with:
-          github-token: ${{ secrets.PAT_WRITE_PKG }}
+          github-token: ${{ steps.app-token.outputs.token }}
           retries: 3
           script: |
             const payload = {
diff --git a/.github/workflows/pull-from-crowdin.yml b/.github/workflows/pull-from-crowdin.yml
index 7da092df7f..3293cb1420 100644
--- a/.github/workflows/pull-from-crowdin.yml
+++ b/.github/workflows/pull-from-crowdin.yml
@@ -5,7 +5,7 @@ on:
   workflow_dispatch:
   workflow_call:
     secrets:
-      BOT_GITHUB_TOKEN:
+      GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY:
         required: true
       CROWDIN_TRANSLATIONS_TOKEN:
         required: true
@@ -15,11 +15,19 @@ jobs:
   pull-from-crowdin:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
-          token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
       - name: Pull translations from Crowdin
         uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
         with:
@@ -34,5 +42,5 @@ jobs:
           github_user_email: ${{ vars.HXPS_GIT_EMAIL }}
           gpg_private_key: ${{ secrets.HXPS_GIT_COMMIT_SIGNING_PRIVATE_KEY }}
         env:
-          GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           CROWDIN_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b88cae45b5..758aa7afaa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -159,7 +159,7 @@ jobs:
     name: Run Crowdin pull pipeline for up-to-date sync
     uses: ./.github/workflows/pull-from-crowdin.yml
     secrets:
-      BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
+      GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
       CROWDIN_TRANSLATIONS_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}
       HXPS_GIT_COMMIT_SIGNING_PRIVATE_KEY: ${{ secrets.HXPS_GIT_COMMIT_SIGNING_PRIVATE_KEY }}