codeql fix feature & Strengthen the release pipeline

.github/actions/deploy-release/action.yml

@@ -29,7 +29,6 @@ runs:
   steps:
     - name: "Echo Inputs"
       run: |
-        echo "user: ${{ inputs.user }}"
         echo "profile: ${{ inputs.profile }}"
       shell: bash
 
@@ -45,9 +44,13 @@ runs:
 
     - name: "Import GPG Key"
       run: |
-        echo "${{ inputs.pgp-private-key }}" | gpg --batch --passphrase "$PASSPHRASE" --import
-      shell: bash  
+        set +x
+        echo "::add-mask::$PGP_PRIVATE_KEY"
+        echo "::add-mask::$PASSPHRASE"
+        echo "$PGP_PRIVATE_KEY" | gpg --batch --passphrase "$PASSPHRASE" --import
+      shell: bash
       env:
+        PGP_PRIVATE_KEY: ${{ inputs.pgp-private-key }}
         PASSPHRASE: ${{ inputs.pgp-passphrase }}
 
     - name: "Ensure Local Repo Directory"
@@ -57,12 +60,17 @@ runs:
       shell: bash
 
     - name: Deploy to Maven Central
-      run: >
-        mvn -B -ntp --show-version
-        -Dmaven.install.skip=true
-        -Dmaven.test.skip=true
-        -Dgpg.passphrase="$GPG_PASSPHRASE"
-        -Dgpg.keyname="$GPG_PUB_KEY"
+      run: |
+        set +x
+        echo "::add-mask::$MAVEN_CENTRAL_USER"
+        echo "::add-mask::$MAVEN_CENTRAL_PASSWORD"
+        echo "::add-mask::$GPG_PASSPHRASE"
+        echo "::add-mask::$GPG_PUB_KEY"
+        mvn -B -ntp --show-version \
+        -Dmaven.install.skip=true \
+        -Dmaven.test.skip=true \
+        -Dgpg.passphrase="$GPG_PASSPHRASE" \
+        -Dgpg.keyname="$GPG_PUB_KEY" \
         clean deploy -P deploy-release
       shell: bash
       env:

.github/workflows/main-build-and-deploy-oss.yml

@@ -8,6 +8,9 @@ on:
   release:
     types: [ "released" ]
 
+permissions:
+  contents: read
+
 jobs:
 
   update-version:
@@ -86,8 +89,10 @@ jobs:
 
   deploy:
     name: Deploy to Maven Central
+    environment: maven-central
     runs-on: ubuntu-latest
     needs: build
+    timeout-minutes: 30
     steps:
       - name: Download artifact
         uses: actions/download-artifact@v7

.github/workflows/multiTenant_deploy_and_Integration_test.yml

@@ -58,7 +58,7 @@ jobs:
       - name: Set REPOSITORY_ID 🔍
         id: set_repository_id
         run: |
-          echo "repository_id=${{ secrets.REPOSITORY_ID }}" >> $GITHUB_OUTPUT
+          echo "repository_id=${{ secrets.MULTITENANT_REPOSITORY_ID }}" >> $GITHUB_OUTPUT
 
       - name: Run mbt build 🔨
         working-directory: app/multi-tenant/central-space/cloud-cap-samples-java

.github/workflows/multiTenant_deploy_and_Integration_test_LatestVersion.yml

@@ -109,7 +109,7 @@ jobs:
       - name: Set REPOSITORY_ID 🔍
         id: set_repository_id
         run: |
-          echo "repository_id=${{ secrets.REPOSITORY_ID }}" >> $GITHUB_OUTPUT
+          echo "repository_id=${{ secrets.MULTITENANT_REPOSITORY_ID }}" >> $GITHUB_OUTPUT
 
       - name: Run mbt build 🔨
         working-directory: app/multi-tenant/central-space/cloud-cap-samples-java

.github/workflows/singleTenant_deploy_and_Integration_test_LatestVersion.yml

@@ -234,40 +234,41 @@ jobs:
             -o "$CF_ORG" \
             -s "$CF_SPACE" > /dev/null
 
-      - name: Fetch and Escape Client Secret
-        id: fetch_secret
+      - name: Fetch and Escape Client Details for single tenant 🔍
+        id: fetch_credentials
         run: |
-          # Fetch the service instance GUID
+          echo "🔄 Fetching client details for single tenant..."
           service_instance_guid=$(cf service demoappjava-public-uaa --guid)
           if [ -z "$service_instance_guid" ]; then
-            echo "Error: Unable to retrieve service instance GUID"; exit 1;
+            echo "❌ Error: Unable to retrieve service instance GUID"; exit 1;
           fi
-          # Fetch the binding GUID
           bindings_response=$(cf curl "/v3/service_credential_bindings?service_instance_guids=${service_instance_guid}")
-
-          binding_guid=$(echo $bindings_response | jq -r '.resources[0].guid')
+          binding_guid=$(echo "$bindings_response" | jq -r '.resources[0].guid')
           if [ -z "$binding_guid" ]; then
-            echo "Error: Unable to retrieve binding GUID"; exit 1;
+            echo "❌ Error: Unable to retrieve binding GUID"; exit 1;
           fi
-
-          # Fetch the clientSecret
           binding_details=$(cf curl "/v3/service_credential_bindings/${binding_guid}/details")
           clientSecret=$(echo "$binding_details" | jq -r '.credentials.clientsecret')
           if [ -z "$clientSecret" ] || [ "$clientSecret" == "null" ]; then
-            echo "Error: clientSecret is not set or is null"; exit 1;
+            echo "❌ Error: clientSecret is not set or is null"; exit 1;
           fi
-
-          # Escape any $ characters in the clientSecret
           escapedClientSecret=$(echo "$clientSecret" | sed 's/\$/\\$/g')
           echo "::add-mask::$escapedClientSecret"
+          clientID=$(echo "$binding_details" | jq -r '.credentials.clientid')
+          if [ -z "$clientID" ] || [ "$clientID" == "null" ]; then
+            echo "❌ Error: clientID is not set or is null"; exit 1;
+          fi
+          echo "::add-mask::$clientID"
           echo "CLIENT_SECRET=$escapedClientSecret" >> $GITHUB_OUTPUT
+          echo "CLIENT_ID=$clientID" >> $GITHUB_OUTPUT
+          echo "✅ Client details fetched successfully!"
       - name: Run integration tests (${{ matrix.tokenFlow }} - ${{ matrix.testClass }})
         env:
-          CLIENT_SECRET: ${{ steps.fetch_secret.outputs.CLIENT_SECRET }}
+          CLIENT_SECRET: ${{ steps.fetch_credentials.outputs.CLIENT_SECRET }}
+          CLIENT_ID: ${{ steps.fetch_credentials.outputs.CLIENT_ID }}
           CF_ORG: ${{ secrets.CF_ORG }}
           CF_SPACE: ${{ secrets.CF_SPACE }}
           CAPAUTH_URL: ${{ secrets.CAPAUTH_URL }}
-          CAPSDM_CLIENT_ID: ${{ secrets.CAPSDM_CLIENT_ID }}
           CF_USER: ${{ secrets.CF_USER }}
           CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
           NOSDMROLEUSERNAME: ${{ secrets.NOSDMROLEUSERNAME }}
@@ -280,7 +281,7 @@ jobs:
           # Gather secrets and other values
           appUrl="$CF_ORG-$CF_SPACE-demoappjava-srv.cfapps.eu12.hana.ondemand.com"
           authUrl="$CAPAUTH_URL"
-          clientID="$CAPSDM_CLIENT_ID"
+          clientID="$CLIENT_ID"
           clientSecret="$CLIENT_SECRET"
           username="$CF_USER"
           password="$CF_PASSWORD"