Update dependencies, add instructions to build and a GitHub Action

[Mingun]

To allow developers without gpg test their changes I moved signing under a flag. Now if you need to sign artefacts you should pass -DperformRelease=true flag to the maven command:

mvn -DperformRelease=true deploy

[generalmimon]

To allow developers without gpg test their changes I moved signing under a flag. Now if you need to sign artefacts you should pass -DperformRelease=true flag to the maven command

Thanks for that, I also needed to comment the maven-gpg-plugin in pom.xml locally to be able to build the Maven package:

-      <plugin>
+      <!-- <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-gpg-plugin</artifactId>
         <version>1.5</version>
         <executions>
           <execution>
             <id>sign-artifacts</id>
             <phase>verify</phase>
             <goals>
               <goal>sign</goal>
             </goals>
           </execution>
         </executions>

-      </plugin>
+      </plugin> -->

So it'll be a nice improvement that I won't have to do that anymore.

[generalmimon]

Are there any breaking changes, migration guides etc. for these major version bumps? If these plugins follow SemVer, we have to assume that there are some incompatible API changes.

[Mingun]

Change log is too long to read (128 commits) but it seems it contains mostly infrastructure changes. I think the best way is just check the output -- it shouldn't be too hard. At least it generates doc and they seems correct.

The most important thing in 2.x -> 3.x migration seems to be summarized in this phrase from the plugin's page:

Starting with version 3.0.0 of the plugin all properties which could be used via command line have been named based on the following schema maven.source.*. Further details can be found in the goal documentations.

As I see we don't use CLI, so that does not influence us.

[Mingun]

@generalmimon, could you comment on this?

[generalmimon]

What does this command actually do? Is it some simulation of the release process, so that we can see errors that would block the release and fix them in advance?

[Mingun]

Copy this from the GitHub Action docs. I think that those guys known the idiomatic way, but here explanations of the switches:

• --batch-mode -- do not request any interactive input if it can arise
• --update-snapshots -- needed only if we have dependencies bu we don't. Will remove
• verify -- runs almost all phases of the project except actual installing into local repository and deploying to the remote repository. It seems ideal for tests

[generalmimon]

Maybe it would make sense to use strategy matrix to test on multiple Java versions.

[Mingun]

Not sure if we need that for such a simple project...

[Mingun]

So what the status?