Release preparation: repair the release path and document publishing

.github/workflows/ci.yml

@@ -72,7 +72,10 @@ jobs:
 
       - name: Gradle Test
         working-directory: zenoh-java
-        run: ./gradlew jvmTest --info
+        # CI builds against the sibling checkouts above, so it opts into the
+        # composite build explicitly. A release does not: it resolves
+        # zenoh-flat-jni from Maven Central like any other consumer.
+        run: ./gradlew jvmTest --info -PuseLocalFlatJni=true
 
   markdown_lint:
     runs-on: ubuntu-latest
@@ -97,25 +100,14 @@ jobs:
       - name: Check whether all jobs pass
         run: echo '${{ toJson(needs) }}' | jq -e 'all(.result == "success")'
 
-  # Publish snapshot packages. These jobs will only be triggered when the CI is executed on main.
-  publish_jvm_snapshot_package:
-    name: Publish JVM snapshot package
+  # Publish snapshot packages. Only triggered when CI runs on main.
+  # One job, because both publications now come from a single Gradle
+  # invocation — see .github/workflows/publish.yml.
+  publish_snapshot_package:
+    name: Publish snapshot package
     if: contains(fromJSON('["refs/heads/main"]'), github.ref)
     needs: ci
-    uses: ./.github/workflows/publish-jvm.yml
-    permissions:
-      contents: read
-      packages: write
-    with:
-      snapshot: true
-      branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish_android_snapshot_package:
-    name: Publish Android snapshot package
-    if: contains(fromJSON('["refs/heads/main"]'), github.ref)
-    needs: ci
-    uses: ./.github/workflows/publish-android.yml
+    uses: ./.github/workflows/publish.yml
     permissions:
       contents: read
       packages: write

.github/workflows/publish-android.yml → .github/workflows/publish.yml

@@ -1,4 +1,10 @@
-name: Publish (Android)
+name: Publish
+
+# Both publications come from a *single* Gradle invocation, so they share one
+# staging repository and one close/release: either both coordinates become public
+# or neither does. That is only possible because zenoh-flat-jni is a Kotlin
+# Multiplatform library — one dependency declaration resolves per target, so an
+# Android-enabled build produces both publications correctly.
 
 on:
   workflow_call:
@@ -17,18 +23,20 @@ on:
         required: false
         default: true
 
-env:
-  CARGO_TERM_COLOR: always
-
+# The native libraries are not built here: they ship inside the
+# org.eclipse.zenoh:zenoh-flat-jni artifact this SDK depends on, already
+# cross-compiled and verified by that repository's release. This workflow only
+# compiles Kotlin and publishes.
 jobs:
-  publish_android_package:
-    name: Publish Android package
-    runs-on: ubuntu-latest
+  publish_package:
+    name: Publish to Maven Central
     permissions:
       contents: read
       packages: write
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
         with:
           ref: ${{ inputs.branch }}
 
@@ -37,28 +45,15 @@ jobs:
           distribution: temurin
           java-version: 11
 
-      - uses: nttld/setup-ndk@v1
-        id: setup-ndk
-        with:
-          ndk-version: r26
-          add-to-path: false
-          link-to-sdk: true
-
-      - name: Install Rust toolchain
-        run: |
-          rustup show
-          rustup component add rustfmt clippy
-
-      - name: Setup Rust toolchains
-        run: |
-          rustup target add armv7-linux-androideabi
-          rustup target add i686-linux-android
-          rustup target add aarch64-linux-android
-          rustup target add x86_64-linux-android
-
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
 
+      # Assembles the artifact and generates its POM without uploading, so a
+      # `maven_publish: false` rehearsal actually proves something. Only the
+      # remote upload below is gated.
+      - name: Assemble and verify the publication
+        run: ./gradlew publishJvmPublicationToMavenLocal publishAndroidReleasePublicationToMavenLocal --info -Pandroid=true
+
       - name: Set pub mode env var
         # Note: This step is intended to allow publishing snapshot packages.
         # It allows to optionally append the property -PSNAPSHOT to the gradle
@@ -72,9 +67,11 @@ jobs:
           fi
 
       - if: ${{ inputs.maven_publish == true }}
-        name: Gradle Publish Android Package to Maven Central repository
+        name: Gradle Publish JVM Package to Maven Central repository
         run: |
-          ./gradlew publishAndroidReleasePublicationToSonatypeRepository ${{ env.RELEASE }} --info -PremotePublication=true -Pandroid=true ${{ env.PUB_MODE }}
+          ./gradlew publishJvmPublicationToSonatypeRepository \
+                    publishAndroidReleasePublicationToSonatypeRepository \
+                    ${{ env.RELEASE }} --info -PremotePublication=true -Pandroid=true ${{ env.PUB_MODE }}
         env:
           CENTRAL_SONATYPE_TOKEN_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME}}
           CENTRAL_SONATYPE_TOKEN_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}

.github/workflows/release.yml

@@ -26,9 +26,9 @@ on:
         type: string
         description: Release number
         required: false
-      zenoh-version:
+      zenoh-flat-jni-version:
         type: string
-        description: Release number of Zenoh
+        description: zenoh-flat-jni release to build against (must already be on Maven Central)
         required: false
       branch:
         type: string
@@ -67,29 +67,14 @@ jobs:
         env:
           LIVE_RUN: ${{ inputs.live-run || false }}
           VERSION: ${{ steps.create-release-branch.outputs.version }}
-          BUMP_DEPS_VERSION: ${{ inputs.zenoh-version }}
-          BUMP_DEPS_PATTERN: ${{ inputs.zenoh-version && 'zenoh.*' || '' }}
-          BUMP_DEPS_BRANCH: ${{ inputs.zenoh-version && format('release/{0}', inputs.zenoh-version) || '' }}
+          FLAT_JNI_VERSION: ${{ inputs.zenoh-flat-jni-version }}
           GIT_USER_NAME: eclipse-zenoh-bot
           GIT_USER_EMAIL: eclipse-zenoh-bot@users.noreply.github.com
 
-  publish-jvm:
-    name: Publish JVM package
+  publish:
+    name: Publish to Maven Central
     needs: tag
-    uses: ./.github/workflows/publish-jvm.yml
-    with:
-      snapshot: ${{ !(inputs.live-run || false) }}
-      branch: ${{ needs.tag.outputs.branch }}
-      maven_publish: ${{ !contains(inputs.maven_publish, 'false') }}
-    permissions:
-      contents: read
-      packages: write
-    secrets: inherit
-
-  publish-android:
-    name: Publish Android package
-    needs: tag
-    uses: ./.github/workflows/publish-android.yml
+    uses: ./.github/workflows/publish.yml
     with:
       snapshot: ${{ !(inputs.live-run || false) }}
       branch: ${{ needs.tag.outputs.branch }}
@@ -101,14 +86,19 @@ jobs:
 
   publish-dokka:
     name: Publish documentation
-    needs: [tag, publish-android, publish-jvm]
+    needs: [tag, publish]
     uses: ./.github/workflows/publish-dokka.yml
     with:
       live-run: ${{ inputs.live-run || false }}
       branch: ${{ needs.tag.outputs.branch }}
+    # peaceiris/actions-gh-pages pushes the generated site to the gh-pages
+    # branch, which the default read-only token cannot do.
+    permissions:
+      contents: write
+    secrets: inherit
 
   publish-github:
-    needs: [tag, publish-android, publish-jvm]
+    needs: [tag, publish]
     runs-on: macos-latest
     steps:
       - uses: eclipse-zenoh/ci/publish-crates-github@main