Automate maven release

[msarahan]

See rapidsai/shared-workflows#660 for more info

Depends on rapidsai/shared-workflows#660 being merged first.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/cuvs/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: cf5bddad-4490-47d0-8fca-b921dcc549c0

📥 Commits

Reviewing files that changed from the base of the PR and between 063b113 and 6da0d0b.

📒 Files selected for processing: 6

• .github/workflows/build.yaml
• .pre-commit-config.yaml
• java/ci/RELEASE.md
• java/ci/assemble_maven_repo.py
• java/ci/test_assemble_maven_repo.py
• pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

📝 Summary

Summary by CodeRabbit

• New Features
  • Java and Lucene Maven artifacts are now published automatically for version-tag releases. Lucene publishing proceeds after Java publication succeeds.
• Documentation
  • Added guidance on release prerequisites, artifact validation, publishing configuration, and rollout checks.

Adds artifact assembly and tag-triggered Maven publishing for Java and Lucene, with validation and release documentation. Also adds a Bandit pre-commit hook and enables Ruff’s B rule family.

Changes: Maven release pipeline

Layer / File(s)	Summary
Maven artifact assembly java/ci/assemble_maven_repo.py, java/ci/test_assemble_maven_repo.py	Assembles module-specific Maven repositories from build artifacts. Validates coordinates, dependencies, native classifiers, required files, and JARs. Tests cover successful assembly and rejected inputs.
Tagged release workflow .github/workflows/build.yaml, java/ci/RELEASE.md	Adds tag-triggered artifact gathering and Java and Lucene publishing jobs. Lucene publishing requires Java publishing to report PUBLISHED. Documents artifact selection, validation, and publication configuration.

Python lint configuration

Layer / File(s)	Summary
Python lint rules .pre-commit-config.yaml, pyproject.toml	Adds Bandit 1.8.6, excluding test_*.py files, and enables Ruff’s B rule family.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Suggested reviewers: cjnolet

Merge Risk: 🟡 Moderate · up to 6da0d

Release publication cannot run with the current shared publisher. Merge the documented shared-workflow prerequisite before merging this change.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main change: automating Maven releases.
Description check		The description relates to the changeset by identifying the shared-workflow dependency and providing further release context.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 2 files. (4 skipped: 4…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[imotov]

That looks good to me in general. While it works with the current setup, it will need to be adjusted when #2867 and follow-up PRs are merged. We are adding support for multiple Lucene versions, which means we will no longer have a single cuvs-lucene-26.12.0.jar, but several cuvs-lucene-10.X-26.12.0.jar jars instead, all of which will have to be published. There will also be a pom-only cuvs-lucene artifact that relocates the old coordinates to cuvs-lucene-10.2, which needs to be published as well.