Adopt GHA Scala Library Release Workflow & use Sonatype token rather than password

[rhystmills]

Co-authored with @rtyley

What does this change?

Our release recently failed due to a change in authentication for Sonatype.

This PR fixes the release process while moving from changesets to gha-scala-library-release-workflow, which is our preferred method for releasing Scala library versions.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 36f0bd9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[rtyley]

This is definitely moving in the right direction - just to point out, two things are changing in this PR:

1. We're switching over to token authentication - and we have to do that, as noted in Sonatype release API auth now requires API token, rejects Nexus UI username & password gha-scala-library-release-workflow#39
2. This repo is switching from using its own credentials (ie SONATYPE_PASSWORD in https://github.com/guardian/apps-rendering-api-models/settings/secrets/actions) to the shared ones used by the whole organisation (ie AUTOMATED_MAVEN_RELEASE_SONATYPE_TOKEN at https://github.com/organizations/guardian/settings/secrets/actions)
   

Note that gha-scala-library-release-workflow was created specifically to achieve a higher level of security, and keep those shared credentials safe. This repo (apps-rendering-api-models) isn't using gha-scala-library-release-workflow at the moment.

I suggest that this repo should switch to using gha-scala-library-release-workflow, rather than the changesets approach! The process can work well with releasing both NPM & Scala artifacts, as in these example PRs:

• Adopt GHA-Scala-Library-Release-Workflow content-api-models#232
• Adopt gha-scala-rel-workflow in the project content-atom#166
• Adopt gha-scala-library-release process content-entity#32

[rtyley]

Looks good to me, we can only really try this out by merging and trying to do a release.

[rtyley]

We needed a couple of fix-ups to get this working (#91 & #92) but we've now successfully released v10.0.0, which was a simultaneous release for NPM & Scala 👍

NPM

We can see that the produced number of files and total filesize is similar for both our new release and the previous 9.0.0 release:

https://www.npmjs.com/package/@guardian/apps-rendering-api-models/v/10.0.0

https://www.npmjs.com/package/@guardian/apps-rendering-api-models/v/9.0.0

Scala

https://index.scala-lang.org/guardian/apps-rendering-api-models/artifacts/apps-rendering-api-models