[ACS-11844] Refactor CI configurations to restrict global secrets and improve env…

[joyjit-hyland]

ACS-11844 -
This pull request restructures how sensitive environment variables (such as credentials and tokens) are set in GitHub Actions workflows. Instead of defining these secrets globally at the top level, they are now set more granularly within individual jobs that require them. This change improves security and makes the workflows easier to maintain by limiting the exposure of secrets to only the jobs that need them.

Key changes by theme:

Security and Secret Management Improvements

• Moved secret environment variables (e.g., MAVEN_USERNAME, MAVEN_PASSWORD, GIT_USERNAME, GIT_PASSWORD, DockerHub and Quay credentials) from global env sections to specific job-level env sections in .github/workflows/ci.yml, .github/workflows/master_release.yml, .github/workflows/arm64.yml, and .github/workflows/precommit_formatter.yml. This reduces the risk of secrets being available to jobs that do not require them. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]

Workflow Maintainability

• The workflows are now clearer about which jobs require which secrets, making them easier to understand and maintain. [1] [2] [3] [4] [5]

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Pull request overview

This PR refactors GitHub Actions workflow configuration to reduce the scope of secrets by moving credentials from workflow-level env: into narrower job-level env: blocks, aiming to restrict global secret exposure and improve environment variable management.

Changes:

• Moved Maven/Nexus credentials from workflow-level env to job-level env in formatter and ARM64 workflows.
• Removed multiple credentials (Git bot, DockerHub, Quay, Azure key, Maven) from workflow-level env in ci.yml and master_release.yml, adding some back at specific jobs.
• Added job-scoped env blocks to selected jobs in ci.yml and master_release.yml.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/precommit_formatter.yml	Moves Nexus credentials from workflow-level to the format-code job env.
.github/workflows/master_release.yml	Removes global secrets and introduces job-level env blocks for several release-related jobs.
.github/workflows/ci.yml	Removes workflow-level secrets and adds limited job-level Git credentials to a couple of jobs.
.github/workflows/arm64.yml	Moves Nexus credentials from workflow-level to the arm64_health_check job env.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alxgomz]

If all you need is to checkout another repo then please check out and stop using BOT_GITHUB_* secrets: https://hyland.atlassian.net/wiki/spaces/TECH/pages/4149151811/Implementing+Required+Verified+Commits+and+GitHub+App+Tokens+for+Workflow+Automation#1.-Do-you-need-to-access-another-repository-in-the-organization%3F

[joyjit-hyland]

Keeping most envs at job level instead of moving them to step level because -

1.MAVEN_USERNAME/PASSWORD → Used by:◦setup-java-build action (via .ci.settings.xml) ◦"Build" step (calls build.sh)◦"Run tests" step (mvn command)◦= 3+ steps per job ❌ Cannot move

2.DOCKERHUB_USERNAME/PASSWORD → Used by:◦setup-java-build action (via .ci.settings.xml)◦"Build" step (calls init.sh)◦= 2+ steps per job ❌ Cannot move

3.QUAY_USERNAME/PASSWORD → Used by:◦setup-java-build action (via .ci.settings.xml)◦"Build" step (calls init.sh)◦= 2+ steps per job ❌ Cannot move

4.GIT_USERNAME/PASSWORD → Potentially used by:◦build_functions.sh (git operations)◦= 1+ step ⚠️ Risky to move

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/ci.yml:56

• The precommit job runs Alfresco/alfresco-build-tools/.../pre-commit, and this repo’s pre-commit hook executes mvn spotless:apply validate (scripts/hooks/check-format-and-headers.sh). After moving Maven credentials out of global env, this job no longer sets MAVEN_USERNAME/MAVEN_PASSWORD, which can cause the Maven-based formatting hook to fail to fetch from internal repos and effectively make the job a no-op.

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

.github/workflows/dependency-graph.yml:16

• This workflow is explicitly intended to "Load Dependency Graph" and uses a dependency scan action. With the new top-level permissions: contents: read, the GITHUB_TOKEN no longer has any write scopes, which can prevent dependency submission to GitHub’s dependency graph. Add the minimal required write permission for dependency submission.

permissions:
  contents: read

[joyjit-hyland]

The job [Upload docker images needed for pipeline tests: <acs.version>-<PIPELINE_TAG_TEXT_INSERT>-<build>](https://github.com/Alfresco/acs-packaging/actions/runs/30355385444/job/91097939617#logs) is failing.

This job was also skipped in previous workflow runs. @goleksyalfresco confirmed that this failure is expected, as the job had already been failing before these changes and is unrelated to this PR.