ci: migrate release pipeline from Jenkins to GitHub Actions - #2

PR summary

Moves the whole build/release pipeline onto GitHub Actions and deletes the Jenkinsfile (plus the now-unused .releaserc and scripts/publish_buildinfo.sh).

Release flow after this change:

release (workflow_dispatch, input: 1.2.3 | patch|minor|major)
  -> bump-my-version bump --tag  -> push HEAD:main --follow-tags
publish (on tag v*)
  build (assert tag == pyproject version, flit build, twine check --strict)
    -> pypi   (environment: pypi, id-token: write, no long-lived credentials)
    -> github-release (gh release create --generate-notes, prerelease for aN/bN/rcN)
    -> docs   (skipped for pre-releases, publishes pydoc to gh-pages)

Jenkins stages that could not be ported (they depend on IBM-internal infrastructure not reachable from GitHub-hosted runners) and are therefore dropped: Artifactory staging publish + build-info, the sdks-gauge pipeline trigger, the Mend scan, and the detectSecrets stage. The last one was attempted — detect-secrets-hook against the committed .secrets.baseline reports ~100 unaudited findings in stubs/*.json, so the internal job clearly runs a different configuration and porting it as-is would have produced a permanently red job.

scripts/pydoc/publish-doc.sh now reuses a gh-pages directory when one already exists (checked out by the workflow with the run's credentials) instead of always cloning, and takes its identity/tag from the environment.

Fixes: n/a — CI-only change, no existing issue.

PR Checklist

• The commit message follows the
  Angular Commit Message Guidelines.
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

PR Type

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• New tests
• Build/CI related changes
• Documentation content changes
• Other (please describe)

What is the current behavior?

GitHub Actions runs tests and docs only; linting, SonarQube, versioning, tagging and all publishing live in the Jenkinsfile and require Jenkins credentials (PyPI username/password, Artifactory).

What is the new behavior?

• test gains a pylint job (Actions builds never linted before), a packaging build job (flit build + twine check --strict), coverage/junit artifacts, fail-fast: false, per-job least-privilege permissions, timeout-minutes and PR-only concurrency cancellation. docs gets the same hardening.
• New sonarqube, dependency-review, release and publish workflows.
• PyPI publishing uses OIDC trusted publishing, so no PyPI credentials are stored anywhere.
• twine and bump-my-version are pinned in requirements-dev.txt (previously provided by the Jenkins agent image).

Does this PR introduce a breaking change?

• Yes
• No

Other information

Repository setup required before the new scan/release workflows do anything:

• PyPI trusted publisher for project ibmcloudant: owner/repo, workflow publish.yml, environment pypi; plus a pypi environment in repo settings.
• SONAR_TOKEN and SONAR_HOST_URL secrets. Without SONAR_HOST_URL the scan step is skipped with a notice rather than failing, and the job never runs for fork PRs (no secret access). Likewise dependency-review probes the dependency graph API and skips when the graph is disabled for the repository.
• The release workflow pushes to main, so it needs a branch-protection bypass for github-actions[bot] if pushes to main are restricted.

Validated: actionlint clean, pylint 10.00/10, 684 unit tests pass locally, flit build --no-use-vcs + twine check --strict pass, and all 12 checks are green on this PR.

Link to Devin session: https://app.devin.ai/sessions/a0876111a5a44b0eb8d24384f93fc2e8
Requested by: @eml2026