ci: automate package publish

[y-lakhdar]

Automate releases and package publication to Github Packages with release-please-action.

Workflow explanation

release.yml

Generates pull requests:

• Generate pull requests labeled autorelease: tagged containing all the fixes and features for the next release, as well as the changelog and version bump based on the commit history. Once merged, a release will be created and the maven-publish.yml action will be triggered.
  
• Generates pull requests labeled autorelease: snapshot after each release by adding -SNAPSHOT suffix to the pom.xml version. Those pull requests are automatically merged by the auto-approve-renovate.yml action.
  

auto-approve-renovate.yml

Auto approve pull requests labeled autorelease: snapshot

maven-publish.yml

Action triggered when a release is created. The action will take the compiled code and package it in its distributable format, then publish it into Github Packages

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/auto-approve-renovate.yml

Package	Version	License	Issue Type
coveo/actions/auto-approve-action	main	Null	Unknown License

Allowed Licenses: 0BSD, Apache-2.0, Apache-2.0 AND BSD-3-Clause AND Python-2.0, Beerware, BlueOak-1.0.0, BSD-1-Clause, BSD-2-Clause, BSD-2-Clause-Patent, BSD-2-Clause-Views, BSD-2-Clause AND MIT, BSD-3-Clause, BSD-3-Clause-Attribution, BSD-3-Clause-Clear, BSL-1.0, CC-BY-3.0, CC-BY-4.0, CC0-1.0, CNRI-Python, curl, HPND, IBM-pibs, ImageMagick, ISC, JSON, MIT, MIT-0, MIT AND Python-2.0, MIT-advertising, mpi-permissive, NCSA, ODC-By-1.0, PDDL-1.0, Plexus, PostgreSQL, PSF-2.0, Python-2.0, Python-2.0.1, SAX-PD, Unlicense, UPL-1.0, W3C, Wsuipa, WTFPL, X11, X11-distribute-modifications-variant, Xerox, Zlib, ZPL-2.1

Scanned Manifest Files

.github/workflows/auto-approve-renovate.yml

• coveo/actions/auto-approve-action@main

.github/workflows/maven-publish.yml

• actions/checkout@3
• actions/setup-java@3

.github/workflows/release.yml

• actions/checkout@3
• actions/setup-java@3
• actions/setup-node@2
• google-github-actions/release-please-action@3

package-lock.json

• @actions/core@1.10.0
• @actions/http-client@2.1.0
• @octokit/auth-app@4.0.13
• @octokit/auth-oauth-app@5.0.6
• @octokit/auth-oauth-device@4.0.5
• @octokit/auth-oauth-user@2.1.2
• @octokit/endpoint@7.0.6
• @octokit/oauth-authorization-url@5.0.0
• @octokit/oauth-methods@2.0.6
• @octokit/openapi-types@18.0.0
• @octokit/request@6.2.5
• @octokit/request-error@3.0.3
• @octokit/types@9.3.1
• @types/btoa-lite@1.0.0
• @types/jsonwebtoken@9.0.2
• @types/node@20.3.0
• btoa-lite@1.0.0
• buffer-equal-constant-time@1.0.1
• deprecation@2.3.1
• ecdsa-sig-formatter@1.0.11
• is-plain-object@5.0.0
• jsonwebtoken@9.0.0
• jwa@1.4.1
• jws@3.2.2
• lru-cache@9.1.2
• lru-cache@6.0.0
• ms@2.1.3
• node-fetch@2.6.11
• once@1.4.0
• safe-buffer@5.2.1
• semver@7.5.1
• tr46@0.0.3
• tunnel@0.0.6
• universal-github-app-jwt@1.1.1
• universal-user-agent@6.0.0
• uuid@8.3.2
• webidl-conversions@3.0.1
• whatwg-url@5.0.0
• wrappy@1.0.2
• yallist@4.0.0

package.json

• @actions/core@^1.10.0
• @octokit/auth-app@^4.0.9

pom.xml

• org.sonatype.plugins:nexus-staging-maven-plugin@1.6.6

[louis-bompart]

lgtm, bump node tho.