Use Eclipse P2 mirror (common-utils)

[peterzhuamazon]

Routes Spotless Eclipse P2 downloads through https://ci.opensearch.org/ to avoid direct download.eclipse.org outages.

Tracking bulletin: opensearch-project/opensearch-build#6421 (comment)

[peterzhuamazon]

expected mirror update.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 9eb0d71.

⛔ Hard block: Issues at High severity or above will block this PR from merging.

Path	Line	Severity	Description
build.gradle	130	high	Eclipse P2 update site mirror redirected from official 'https://download.eclipse.org/' to 'https://ci.opensearch.org/'. This modifies the source from which Eclipse formatter plugins and dependencies are resolved at build time. If the mirror serves tampered artifacts, malicious build tooling could be injected into the build environment. Per mandatory flagging rules, any change to package source URLs must be flagged and verified by maintainers regardless of apparent legitimacy.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 1 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 Multiple PR themes Sub-PR theme: Remove auto-release workflow Relevant files: .github/workflows/auto-release.yml Sub-PR theme: Pin GitHub Actions to updated SHAs Relevant files: .github/workflows/ci.yml .github/workflows/maven-publish.yml

⚡ Recommended focus areas for review Step Ordering actions/setup-java is now invoked before actions/checkout. If the repository contains a pom.xml/Gradle wrapper or caching configuration that setup-java expects to find in the workspace (e.g., when cache: is later added, or if the action attempts to read project files), running it before checkout will fail or miss those files. Also, subsequent steps referencing the checked-out repo won't have it available until after the setup-java step. - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 with: distribution: temurin # Temurin is a distribution of adoptium java-version: 21 - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 Workflow Deleted auto-release.yml has been deleted as part of this PR. The PR title/description indicates the purpose is routing Eclipse P2 downloads through a mirror and updating action pins—removing the auto-release workflow appears unrelated and may unintentionally disable automated releases for this repository. Confirm this deletion is intentional.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.55%. Comparing base (3a69aab) to head (392cdde).
⚠️ Report is 116 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #993      +/-   ##
============================================
- Coverage     73.97%   70.55%   -3.42%     
- Complexity      916     1149     +233     
============================================
  Files           135      175      +40     
  Lines          6102     7971    +1869     
  Branches        753      956     +203     
============================================
+ Hits           4514     5624    +1110     
- Misses         1253     1948     +695     
- Partials        335      399      +64     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gaiksaya]

We need the auto-release workflow, maybe similar to how other standalone repos have. We can remove the token usage as it is not required.