Proof of concept to release snapshots to sonatype

[georgeblahblah]

Co-authored-by: David Lawes david.lawes@guardian.co.uk

What does this change?

This PR adds a proof of concept for releasing snapshots to sonatype via github actions. This PR makes a couple of changes:

• We define a new github workflow: the workflow is run when a release is published and only when the release is a "prerelease". The workflow references repository secrets (replicating what we expect local users to define) and triggers sbt to release a snapshot
• We started mapping out the release steps we'd need for the snapshot release. This is a work in progress, and there could be some refactoring after we've worked out what the non-snapshot release process could be.
• We had to bump the version of the sbt-pgp plugin to enable signing to take place successfully.

How was this tested?

During development the github workflow was triggered on push events. For the final configuration of the work flow we can see the action was successfully completed:

• workflow completed successfully
• snapshot releases could be found in maven (content api client 2.12, content api client 2.13, content api client default 2.12, content api client 2.13 https://oss.sonatype.org/content/repositories/snapshots/com/gu/)

What next?

After this change is deployed snapshot releases could be made via the github UI by creating a new prerelease. Creating the new prerelease should trigger the workflow (including parsing the version correctly from the release name). This last part of the flow hasn't been tested yet (it can't be until this change has been merged?). After this change has been merged we'd want to:

• make a prerelease
• confirm the workflow is triggered
• confirm the workflow parses the expected version number
• confirm the snapshot releases are created

If we're happy with the prerelease proof of concept we could then:

• develop an equivalent workflow for releasing new non-snapshot releases via the github ui
• update the readme/docs describing how to release (including naming conventions for each release)

[DavidLawes]

@rowannekabalan @fredex42 The proof of concept successfully published snapshot releases to sonatype, so I think this might be ready for a review! I'd hope that all changes here are suitably isolated from the current release process (aside from the version bump of plugin sbt-pgp). Let me know your thoughts, happy to chat if that's better!