Add nightly SNAPSHOT release to the GitHub Packages

[krisbanas]

I came across the discussions under #941 and the issue #769 and had a look at the snapshot releases.

Results

• A draft of a GitHub Actions pipeline that builds with JDK 17 and publishes to GitHub Packages
  • The pipeline is set to run on cron (1AM) and on new commits to master
• I tested the publishing to Packages on my fork. .
• The GitHub Packages repo indexes the artifacts as 3.0.0-SNAPSHOT and keeps them timestamped under the hood.
• I set up a test Gradle project to test resolving the snapshot, it downloads the most recent artifact (upon forcing it to --refresh-dependencies).

Questions/Issues

• The pipeline uses altDeploymentRepository flag (see documentation here) to override the repositories defined in pom.xml instead of editing the file itself. The snapshot repo can instead be adjusted in the POM file.
• GitHub Packages seem not to implement any retention policy for snapshots. It means producing new artifacts every day with no clean-up of older ones. GitHub hints at using a maintenance pipeline to handle it.
• Compared to what I've found on the maven central repo, the signatures (.asc) files are missing in the Packages.
• Another issue is lack of support for unauthenticated dependency fetching from the Packages. You need a PAT to authenticate and GitHub is not likely to change it (documentation) (community discussion).
• Looking at the CI pipeline, the ./mvnw deploy... command in the snapshot release pipeline likely misses some parameters.
• I will document the process in README if you decide to go with this solution.

Let me know what you think.

[chrjohn]

Thank you @krisbanas , will take a look.

[krisbanas]

Hi @chrjohn, did you find a moment to have a look?

[chrjohn]

Hi @krisbanas , no unfortunately not. Totally swamped in regular work work. :-/