Add support for reproducibility on reproducible-central

[algomaster99]

We should create a commit and push it to the default branch so that our releases have a corresponding commit. This is good because it will be easy to integrate the project with reproducible central to guarantee reproducibility.

This release may not be fixed, but for later releases we must have a commit.

[monperrus]

yes, we want to be compatible with reproducible central.

Commit corresponding to latest release X does not exist in the main branch
where is this convention documented? enforced?

[algomaster99]

This is from the comment INRIA/spoon#5760 (comment)

what I really need is either no beta to Maven Central, or if you want to publich to Maven Central, publish a git tag as you do with releases

[yogyagamage]

This release may not be fixed, but for later releases we must have a commit.

The release commit will be added to the main branch automatically, when we run the release pipeline successfully.
In this release, the pipeline failed at merging because it took some time to pass the checks. So, I manually merged the branch. I have missed this point, that we should include the release commit. I squashed the commits, that is why we don't have the corresponding commit in the main branch. But in the pipeline we merge with fast forward, so the commit will be included.

On a side note, we should fix the pipeline to wait until checks are passed to merge.

[monperrus]

there is already some files in reproducible-central about maven-lockfile: https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/io/github/chains-project/maven-lockfile/README.md

However, maven-lockfile is not reproducible.

[kthfre]

I don't think there is a good solution for this at the moment as long as quarkus is a dependency. The ordering of the content in a couple of class files produced during the build is non-deterministic which of course affects the checksum of the jar file of the github action module. See: 1, 2, 3, etc. They seem to be looking to improve on this.

[monperrus]

thanks for the analysis. why do we need quarkus? can we remove the dependency and the corresponding feature?

[kthfre]

It is a dependency of the Java package used for interaction with github actions, which essentially is the entire (relatively small) application. I'm not familiar enough with the Java packages available for this, and if there are alternatives, whether it is "worth" switching is not something I can determine.

[LogFlames]

Not fixed, only added badge to readme.