Decommission Artifactory and complete Maven artifact migration to BunnyCDN S3

Summary

We are decommissioning JFrog Artifactory (repo.dotcms.com) and moving all Maven/artifact publishing to the BunnyCDN S3-compatible storage zone.

• S3 endpoint: https://ny-s3.storage.bunnycdn.com (region ny)
• Public CDN: https://dotcms-repo.b-cdn.net
• Org secrets: MAVEN_BUNNY_RW_USERNAME (storage-zone name / access key id), MAVEN_BUNNY_RW_PASSWORD (storage-zone password / secret key)
• Layout: https://dotcms-repo.b-cdn.net/libs-release/com/dotcms/...
  • .../libs-release/com/dotcms/dotcms-core/26.09.14-01/dotcms-core-26.09.14-01.jar
  • .../libs-release/com/dotcms/starter/20260910/starter-20260910.zip

Done in the migration PR

• Added .github/scripts/publish-to-s3/publish.sh — publishes a version subtree of ~/.m2/repository (and single files) to S3, regenerates maven-metadata.xml, and uploads .sha1/.md5.
• Added deploy-maven-s3 composite action; deployment/release phases now mvn install locally and upload from ~/.m2/repository.
• Starter publishing now uploads the zip via the script.
• Removed the deploy-jfrog action.
• Updated pom.xml/parent/pom.xml download repositories to the CDN and dropped the Artifactory distributionManagement.
• Updated in-repo consumers (dotCLI action workflow, docker examples, onboarding docs).

Remaining work

• Provision secrets/vars and retire Artifactory ones. Add org secrets MAVEN_BUNNY_RW_USERNAME / MAVEN_BUNNY_RW_PASSWORD; add MAVEN_S3_BUCKET, MAVEN_S3_PREFIX, MAVEN_S3_ENDPOINT, MAVEN_S3_REGION, MAVEN_S3_PUBLIC_URL repo variables. Remove EE_REPO_USERNAME, EE_REPO_PASSWORD, ARTIFACTORY_URL, ARTIFACTORY_REPO, ARTIFACTORY_ACCESS_TOKEN.
• Confirm the storage-zone/bucket name and the prefix (/libs-release vs the /libs-releases stated in the request). Adjust MAVEN_S3_BUCKET/MAVEN_S3_PREFIX if needed.
• CLI (JReleaser) publishing still targets Artifactory: tools/dotcms-cli/jreleaser.yml (upload.artifactory for native zips + runner jar) and cicd_release-cli.yml (JRELEASER_ARTIFACTORY_* using the retired EE_REPO_* secrets). Migrate to S3 or drop the Artifactory upload.
• Snapshot repository root. Decide whether -SNAPSHOT artifacts live under libs-release (current script default) or a separate libs-snapshot root; the POM snapshot repos currently point at libs-snapshot.
• CDN cache strategy for mutable paths (*-SNAPSHOT, maven-metadata.xml) — ensure consumers do not get stale latest/metadata, and document any purge step.
• Consumer cutover. Redirect/retire repo.dotcms.com/artifactory for external consumers (customers, plugins, SDKs) and announce the new base URL; keep a deprecation window.
• Audit remaining references outside this repo: plugin-examples, community/plugin repos, build images/Dockerfiles, internal runbooks that read repo.dotcms.com.
• Verify end-to-end: run a release (or dry-run) and confirm artifacts, maven-metadata.xml, checksums, and starter zips resolve from the CDN; confirm mvn resolves com.dotcms dependencies from the new repository.
• Decommission Artifactory once usage is zero (monitor access logs).

Notes / risks

• S3 has no real folders or automatic Maven metadata; the helper script compensates by creating key prefixes and regenerating metadata.
• Checksums are uploaded by the script so Gradle-style consumers keep working.

Start by reading .github/scripts/publish-to-s3/publish.sh and the deploy-maven-s3 action, then inspect tools/dotcms-cli/jreleaser.yml and cicd_release-cli.yml for remaining Artifactory publishing. Run the release or dry-run verification described in the issue. Done means the selected publishing paths resolve through BunnyCDN with metadata, checksums, and starter artifacts verified, and retired references are removed or documented.