Description

Adds a complete CI/CD pipeline, including build/test automation, security scanning, and Maven Central publishing for auth0-springboot-api.

Changes

GitHub Actions (.github/actions/)

Seven composite actions for release orchestration:

• get-version — reads version from .version file
• get-prerelease — detects beta/alpha pre-release versions
• get-release-notes — extracts release notes from PR body
• tag-exists — checks if git tag already exists
• maven-publish — installs Java (SDKMAN), validates Gradle wrapper, publishes to Sonatype Maven Central
• release-create — creates GitHub release via softprops/action-gh-release
• rl-scanner — Reversing Labs security scanning on build artifacts

Workflows (.github/workflows/)

• build-and-test.yml — runs on PR/push/merge_group; builds all modules, runs tests, uploads Codecov and test reports
• gradle-wrapper-validation.yml — validates Gradle wrapper integrity on PR/push
• snyk.yml — Snyk vulnerability scanning on PR/push + bi-monthly schedule
• rl-scanner.yml — reusable workflow for Reversing Labs artifact scanning
• java-release.yml — reusable release workflow (version → prerelease check → tag check → Maven publish → GitHub release)
• release.yml — top-level release trigger: runs RL scanner then Java release; triggered on merged release/* PRs or manual dispatch

Publishing Infrastructure

• gradle/versioning.gradle — version management from .version file with snapshot support (-PisSnapshot=false)
• gradle/maven-publish.gradle — shared Maven publishing config with PGP signing (in-memory keys), sources JAR, javadoc JAR, full POM metadata
• gradle.properties — POM metadata properties (group: com.auth0, artifactId: auth0-springboot-api)
• Root build.gradle — added io.github.gradle-nexus.publish-plugin with Sonatype Central repository config
• auth0-springboot-api/build.gradle — replaced inline publishing block with shared gradle scripts

Dependency Management

• .github/dependabot.yml — daily Dependabot updates for GitHub Actions and Gradle dependencies (semver-major ignored)

Publishing Scope

Only auth0-springboot-api is published to Maven Central as com.auth0:auth0-springboot-api. The auth0-api-java module is compiled as an internal dependency but is not published. The playground module is excluded entirely.