[kkorotkov]

The release workflow failed in the checkout step (run 39423032478) with git@github.com: Permission denied (publickey). The repository has no deploy keys, so the key in REPO_SSH_KEY is no longer accepted. This PR drops the SSH key and uses the job's GITHUB_TOKEN instead.

• Remove ssh-key: REPO_SSH_KEY from the checkout step, so actions/checkout uses the default token and persists it for later git commands.
• Add permissions: contents: write to the release job. The only git write is the tag pushed by scm:tag.
• Switch <connection> and <developerConnection> in pom.xml to the HTTPS URL. scm:tag pushes to developerConnection, which was an SSH URL and would still need a key.
• Stop installing ssh in the container. gnupg2 is still needed.

The master ruleset does not cover tags, so the tag push is not blocked. The release does not push commits to master. Pushes made with GITHUB_TOKEN do not trigger other workflows, and none of them run on tags.

Tested locally against a git HTTP server that requires the same Authorization: basic header the checkout action stores. With the checkout-style credentials include, mvn scm:tag pushed the tag. Without it the push failed with an authentication error. Not tested against github.com or inside the maven:3-eclipse-temurin-17 container, so the first release run after merge is the final check.

REPO_SSH_KEY is unused after this change and can be deleted.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 6def6a7.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None