Add nightly SNAPSHOT release to GitHub Packages

[krisbanas]

Fixes #769

I came across the discussions under #941 and the issue #769 and had a look at the snapshot releases.

Results

• A draft of a GitHub Actions pipeline that builds with JDK 17 and publishes to GitHub Packages
  • The pipeline is set to run on cron (1AM) and on new commits to master
• I tested the publishing to Packages on my fork. .
• The GitHub Packages repo indexes the artifacts as 3.0.0-SNAPSHOT and keeps them timestamped under the hood.
• I set up a test Gradle project to test resolving the snapshot, it downloads the most recent artifact (upon forcing it to --refresh-dependencies).

Questions/Issues

• The pipeline uses altDeploymentRepository flag (see documentation here) to override the repositories defined in pom.xml instead of editing the file itself. The snapshot repo can instead be adjusted in the POM file.
• GitHub Packages seem not to implement any retention policy for snapshots. It means producing new artifacts every day with no clean-up of older ones. GitHub hints at using a maintenance pipeline to handle it.
• Compared to what I've found on the maven central repo, the signatures (.asc) files are missing in the Packages.
• Another issue is lack of support for unauthenticated dependency fetching from the Packages. You need a PAT to authenticate and GitHub is not likely to change it (documentation) (community discussion).
• Looking at the CI pipeline, the ./mvnw deploy... command in the snapshot release pipeline likely misses some parameters.
• I will document the process in README if you decide to go with this solution.

Let me know what you think.

[chrjohn]

Thank you @krisbanas , will take a look.

[krisbanas]

Hi @chrjohn, did you find a moment to have a look?

[chrjohn]

Hi @krisbanas , no unfortunately not. Totally swamped in regular work work. :-/

[chrjohn]

Hi @krisbanas , thanks for your work. 👍 Please go ahead with the mentioned documentation.
It improves the current situation a lot so I'm happy to go with this. We can adapt and care for the questions/issues along the way...

[krisbanas]

Thanks for the feedback. I added the documentation - please have a look!

[chrjohn]

Just a quick question: we need to be compatible to JDK8. Why does the build use JDK17? Was this intentional?
I guess the maven.compiler.target should do the trick to produce JDK8 compatible classes. But why then not choose JDK21 for compilation?
Just out of curiosity... :)

[krisbanas]

I checked and the created files are compatible with JDK8. I chose JDK17 as this is the most recent version that's used in the CI pipeline, I didn't give it much though :)

Should I change it to Java 21?

[chrjohn]

Should I change it to Java 21?

Yes, please do.

[chrjohn]

And can/should we also put the github repo here:

quickfixj/pom.xml

Lines 606 to 615 in bf6a39c

	<distributionManagement>
	<snapshotRepository>
	<id>ossrh</id>
	<url>https://oss.sonatype.org/content/repositories/snapshots</url>
	</snapshotRepository>
	<repository>
	<id>ossrh</id>
	<url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
	</repository>
	</distributionManagement>

???

The sonatype snapshot repo is not useful for our purpose since we can only upload one snapshot with the same version.