ACS-12080: Migrate ATS release to verified commits and GitHub App tokens (maven-release-slim) (#1321)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: gionn <71768+gionn@users.noreply.github.com>

.github/copilot-instructions.md

@@ -0,0 +1,72 @@
+# Copilot / AI assistant instructions — Alfresco Transform Core
+
+Guidance for AI coding agents working in this repository. Keep changes minimal,
+consistent with existing conventions, and always buildable.
+
+## What this project is
+
+Alfresco Transform Core contains the common transformer ("T-Engine") code plus a set of
+concrete T-Engine implementations. Each T-Engine is a Spring Boot application that is also
+packaged as a Docker image. Client, T-Engine and T-Router exchange JSON described by the
+shared `model` library.
+
+## Tech stack
+
+- **Java 17** (`java.version` in the root `pom.xml`); some artifacts also target Java 11
+  (`acs-compatible.java.version`) for ACS compatibility.
+- **Spring Boot** (inherited from `spring-boot-starter-parent`).
+- **Maven** multi-module build. **Docker** images per engine.
+- Code style enforced via **Spotless** and license-header checks; hooks run through
+  **pre-commit**.
+
+## Repository layout
+
+- `model/` — JSON data model + transform-selection logic, packaged as a jar.
+- `engines/base/` — code common to all T-Engines (the current base).
+- `engines/<name>/` — individual T-Engines (`imagemagick`, `libreoffice`, `misc`,
+  `pdfrenderer`, `tika`, `example`) plus `aio` (All-In-One). Each builds a Spring Boot jar
+  and a Docker image.
+- `deprecated/alfresco-transformer-base/` — the original base; retained but superseded by
+  `engines/base`.
+- `_ci/` — CI helper scripts (`build.sh`, `test.sh`, `cache_artifacts.sh`).
+- `docs/` — additional documentation (transform config, probes, scaling, release, …).
+- `scripts/hooks/` — local pre-commit hook scripts (formatting + license headers).
+
+Maven profiles select which modules build: `full-build` (default, everything), `base`,
+and one per engine (e.g. `imagemagick`, `libreoffice`, `misc`, `pdf-renderer`, `tika`).
+
+## Build & test
+
+- Full local build with per-engine Docker images and integration setup:
+  ```bash
+  mvn clean install -Plocal,docker-it-setup
+  ```
+- Base libraries only: `mvn clean install -Pbase`.
+- A single engine locally, mirroring CI: `bash _ci/build.sh <buildProfile>` then
+  `bash _ci/test.sh <testProfile>` (see the matrix in `.github/workflows/ci.yml`).
+- Integration tests are `*IT.java` and require the `docker-it-setup` profile.
+
+## Running a T-Engine
+
+A T-Engine is a Spring Boot app (`org.alfresco.transform.base.Application`):
+
+- `mvn spring-boot:run`, or `java -jar target/<engine>-{version}.jar`.
+- Serves on port `8090`; test page at `http://localhost:8090/`, config at
+  `http://localhost:8090/transform/config`.
+
+## Conventions
+
+- Keep formatting Spotless-clean and preserve license headers — the
+  `scripts/hooks/check-format-and-headers.sh` pre-commit hook fixes Java files.
+- Pin dependency and plugin versions via `<properties>` in the root `pom.xml` rather than
+  inline in child modules.
+- In GitHub Actions, third-party actions must be SHA-pinned with a version comment; only
+  `Alfresco/alfresco-build-tools/*` may use release tags. Never place secrets in a
+  workflow-level `env` block — scope them to the steps that need them.
+
+## Where to look first
+
+- Root `pom.xml` for versions, profiles and module wiring.
+- `README.md` for a high-level overview and artifact/Docker details.
+- `docs/` for transform config, transformer selection, probes and the release process.
+

.github/dependabot.yml

@@ -1,3 +1,5 @@
+# Documentation for all configuration options:
+# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
 version: 2
 registries:
   maven-alfresco-internal:
@@ -6,62 +8,52 @@ registries:
     username: ${{secrets.NEXUS_USERNAME}}
     password: ${{secrets.NEXUS_PASSWORD}}
 updates:
-- package-ecosystem: maven
-  directory: "/"
-  schedule:
-    interval: daily
-    time: "22:00"
-    timezone: Europe/London
-  open-pull-requests-limit: 99
-  registries:
-  - maven-alfresco-internal
-- package-ecosystem: docker
-  directory: "engines/aio"
-  schedule:
-    interval: daily
-    time: "22:00"
-    timezone: Europe/London
-  open-pull-requests-limit: 99
-- package-ecosystem: docker
-  directory: "engines/libreoffice"
-  schedule:
-    interval: daily
-    time: "22:00"
-    timezone: Europe/London
-  open-pull-requests-limit: 99
-- package-ecosystem: docker
-  directory: "engines/imagemagick"
-  schedule:
-    interval: daily
-    time: "22:00"
-    timezone: Europe/London
-  open-pull-requests-limit: 99
-- package-ecosystem: docker
-  directory: "engines/misc"
-  schedule:
-    interval: daily
-    time: "22:00"
-    timezone: Europe/London
-  open-pull-requests-limit: 99
-- package-ecosystem: docker
-  directory: "engines/tika"
-  schedule:
-    interval: daily
-    time: "22:00"
-    timezone: Europe/London
-  open-pull-requests-limit: 99
-- package-ecosystem: docker
-  directory: "engines/pdfrenderer"
-  schedule:
-    interval: daily
-    time: "22:00"
-    timezone: Europe/London
-  open-pull-requests-limit: 99
-- package-ecosystem: github-actions
-  directory: "/"
-  schedule:
-    interval: monthly
-  groups:
-    github-actions:
-      patterns:
-      - "*"
+  - package-ecosystem: "github-actions"
+    directories:
+      - "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "github_actions"
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "maven"
+    directories:
+      - "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 99
+    registries:
+      - maven-alfresco-internal
+    labels:
+      - "dependencies"
+      - "java"
+    cooldown:
+      default-days: 7
+    groups:
+      maven:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "docker"
+    directories:
+      # Each T-Engine ships its own Dockerfile; the glob collapses the siblings.
+      - "engines/*"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 99
+    labels:
+      - "dependencies"
+      - "docker"
+    cooldown:
+      default-days: 7
+    groups:
+      docker:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -22,17 +22,16 @@ on:
     - cron: '0 5 * * 1'
   workflow_dispatch:
 
+# NOTE: Secrets are intentionally NOT declared at the workflow (top) level.
+# A workflow-level `env` exposes secrets to every job/step (including third-party
+# actions). Secrets are scoped to the individual steps that need them instead.
 env:
-  DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-  NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
-  NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
-  QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
-  QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
-  GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
-  GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
-  GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
   GITHUB_ACTIONS_DEPLOY_TIMEOUT: 120
+  # Both variables are required to be set before the release process starts.
+  # As the release is triggered by a commit message with "[release]" keyword on a release branch,
+  # setting these variables to new values can be done in the same commit and will indicate the release and the dev versions in it.
+  RELEASE_VERSION: "5.4.5-A.3" # The version of the release (tag).
+  DEVELOPMENT_VERSION: "5.4.5-A.4-SNAPSHOT" # The version that will be set in pom files after the release (next dev version)
 
 permissions:
   contents: read
@@ -41,7 +40,7 @@ jobs:
   pre_commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v9.3.1
+      - uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v18.21.2
 
   test_run_check:
     name: "Test run check"
@@ -66,10 +65,17 @@ jobs:
       - test_run_check
     if: needs.test_run_check.outputs.tests == 'true' && github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v9.3.1
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
-      - uses: Alfresco/ya-pmd-scan@v4.1.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.2
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
+      - uses: Alfresco/ya-pmd-scan@e817ecd9292844800451c42f07cdebdb14268cfa # v4.1.0
+        env:
+          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
         with:
           classpath-build-command: "mvn -ntp package -DskipTests"
 
@@ -81,16 +87,16 @@ jobs:
       - test_run_check
     if: needs.test_run_check.outputs.tests == 'true'
     steps:
-      - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
       - name: "Login to Docker Hub"
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: "Login to Quay.io"
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
@@ -100,14 +106,28 @@ jobs:
           echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
           sudo service docker restart
       - name: "Clean-up SNAPSHOT artifacts"
-        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
+        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
+        env:
+          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
         run: mvn -B -U -q clean install -DadditionalOption=-Xdoclint:none -DskipTests -Dmaven.javadoc.skip=true -Dmaven.wagon.http.pool=false -Pbase
       - name: "Cache LibreOffice"
         run: bash _ci/cache_artifacts.sh
       - name: "Run tests"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
+        env:
+          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
         run: mvn -B -U clean deploy -DadditionalOption=-Xdoclint:none -Dmaven.javadoc.skip=true -Dmaven.wagon.http.pool=false -Pbase
 
   all_tests_matrix:
@@ -140,16 +160,16 @@ jobs:
             buildProfile: full-build
             testProfile: aio-test
     steps:
-      - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
       - name: "Login to Docker Hub"
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: "Login to Quay.io"
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
@@ -159,14 +179,28 @@ jobs:
           echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
           sudo service docker restart
       - name: "Clean-up SNAPSHOT artifacts"
-        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
+        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
       - name: "Build local docker image"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
+        env:
+          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
         run: bash _ci/build.sh ${{ matrix.buildProfile }}
       - name: "Cache LibreOffice"
         run: bash _ci/cache_artifacts.sh
       - name: "Run tests"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
+        env:
+          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
         run: bash _ci/test.sh ${{ matrix.testProfile }}
 
   e2e_javaruntime_tests:
@@ -181,16 +215,16 @@ jobs:
       matrix:
         java: [ '21', '25' ]
     steps:
-      - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
       - name: "Login to Docker Hub"
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: "Login to Quay.io"
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
@@ -200,9 +234,16 @@ jobs:
           echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
           sudo service docker restart
       - name: "Clean-up SNAPSHOT artifacts"
-        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
+        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
       - name: "Build local docker image"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
+        env:
+          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
         run: bash _ci/build.sh full-build
       - name: "Cache LibreOffice"
         run: bash _ci/cache_artifacts.sh
@@ -212,6 +253,12 @@ jobs:
           SMOKE_TESTS: true
           SKIP_DEPLOY: true
           JAVA_RUNTIME_VERSION: ${{ matrix.java }}
+          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
         run: bash _ci/test.sh aio-test
 
   release:
@@ -224,23 +271,32 @@ jobs:
       github.event_name != 'pull_request' &&
       (github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || startsWith(github.ref_name, 'HF/'))
     steps:
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v9.3.1
-      - uses: actions/checkout@v4
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          persist-credentials: false
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: write
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
         with:
           platforms: linux/amd64,linux/arm64
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - name: "Login to Docker Hub"
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: "Login to Quay.io"
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
@@ -250,14 +306,26 @@ jobs:
           echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
           sudo service docker restart
       - name: "Clean-up SNAPSHOT artifacts"
-        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
-      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v9.3.1
+        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
+      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v18.21.2
         with:
-          username: ${{ env.GIT_USERNAME }}
-          email: ${{ env.GIT_EMAIL }}
+          username: ${{ secrets.BOT_GITHUB_USERNAME }}
+          email: ${{ secrets.BOT_GITHUB_EMAIL }}
           global: true
       - name: "Cache LibreOffice"
         run: bash _ci/cache_artifacts.sh
       - name: "Release"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
-        run: bash _ci/release.sh
+        uses: Alfresco/alfresco-build-tools/.github/actions/maven-release-slim@v18.21.2
+        env:
+          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          release-version: ${{ env.RELEASE_VERSION }}
+          development-version: ${{ env.DEVELOPMENT_VERSION }}
+          maven-args: "-DskipTests -Dmaven.javadoc.skip=true -DadditionalOption=-Xdoclint:none -Dmaven.wagon.http.pool=false"

.github/workflows/precommit_formatter.yml

@@ -16,22 +16,6 @@ jobs:
       contents: write
     if: contains(github.event.head_commit.message, '[reformat code]')
     steps:
-      - uses: actions/checkout@v4
-      - name: Set up Python ${{ inputs.python-version }}
-        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v18.21.2
         with:
-          python-version: "3.9"
-      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
-        continue-on-error: true
-        with:
-          extra_args: --all-files
-      - name: Update secrets baseline
-        run: pip install detect-secrets && detect-secrets scan --baseline .secrets.baseline
-      - uses: Alfresco/alfresco-build-tools/.github/actions/git-commit-changes@v8.26.0
-        with:
-          username: ${{ secrets.BOT_GITHUB_USERNAME }}
-          add-options: -u
-          commit-message: "Apply Pre-Commit code formatting"
-          skip-if-no-changes: true
-      - name: Push changes
-        run: git push
+          auto-commit: "true"