Release preparation: repair the release path and document publishing

.github/workflows/ci.yml

@@ -60,7 +60,10 @@ jobs:
 
       - name: Gradle Test
         working-directory: zenoh-kotlin
-        run: ./gradlew jvmTest --info
+        # CI builds against the sibling checkouts above, so it opts into the
+        # composite build. A release does not: it resolves zenoh-flat-jni from
+        # Maven Central like any other consumer.
+        run: ./gradlew jvmTest --info -PuseLocalFlatJni=true
 
   markdown_lint:
     runs-on: ubuntu-latest
@@ -85,25 +88,13 @@ jobs:
       - name: Check whether all jobs pass
         run: echo '${{ toJson(needs) }}' | jq -e 'all(.result == "success")'
 
-  # Publish snapshot packages. These jobs will only be triggered when the CI is executed on main.
-  publish_jvm_snapshot_package:
-    name: Publish JVM snapshot package
+  # Publish snapshot packages. Both coordinates come from one Gradle
+  # invocation — see .github/workflows/publish.yml.
+  publish_snapshot_package:
+    name: Publish snapshot package
     if: contains(fromJSON('["refs/heads/main"]'), github.ref)
     needs: ci
-    uses: ./.github/workflows/publish-jvm.yml
-    permissions:
-      contents: read
-      packages: write
-    with:
-      snapshot: true
-      branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish_android_snapshot_package:
-    name: Publish Android snapshot package
-    if: contains(fromJSON('["refs/heads/main"]'), github.ref)
-    needs: ci
-    uses: ./.github/workflows/publish-android.yml
+    uses: ./.github/workflows/publish.yml
     permissions:
       contents: read
       packages: write

.github/workflows/publish-android.yml → .github/workflows/publish.yml

@@ -1,4 +1,10 @@
-name: Publish (Android)
+name: Publish
+
+# Both publications come from a *single* Gradle invocation, so they share one
+# staging repository and one close/release: either both coordinates become public
+# or neither does. That is only possible because zenoh-flat-jni is a Kotlin
+# Multiplatform library — one dependency declaration resolves per target, so an
+# Android-enabled build produces both publications correctly.
 
 on:
   workflow_call:
@@ -17,9 +23,13 @@ on:
         required: false
         default: true
 
+# The native libraries are not built here: they ship inside the
+# org.eclipse.zenoh:zenoh-flat-jni artifact this SDK depends on, already
+# cross-compiled and verified by that repository's release. This workflow only
+# compiles Kotlin and publishes.
 jobs:
-  publish_android_package:
-    name: Publish Android package
+  publish_package:
+    name: Publish to Maven Central
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -37,6 +47,12 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
 
+      # Assembles both artifacts and generates their POMs without uploading, so
+      # a `maven_publish: false` rehearsal actually proves something. Only the
+      # remote upload below is gated.
+      - name: Assemble and verify the publications
+        run: ./gradlew publishJvmPublicationToMavenLocal publishAndroidReleasePublicationToMavenLocal --info -Pandroid=true
+
       - name: Set pub mode env var
         # Note: This step is intended to allow publishing snapshot packages.
         # It allows to optionally append the property -PSNAPSHOT to the gradle
@@ -50,9 +66,11 @@ jobs:
           fi
 
       - if: ${{ inputs.maven_publish == true }}
-        name: Gradle Publish Android Package to Maven Central repository
+        name: Gradle Publish to Maven Central repository
         run: |
-          ./gradlew publishAndroidReleasePublicationToSonatypeRepository ${{ env.RELEASE }} --info -PremotePublication=true -Pandroid=true ${{ env.PUB_MODE }}
+          ./gradlew publishJvmPublicationToSonatypeRepository \
+                    publishAndroidReleasePublicationToSonatypeRepository \
+                    ${{ env.RELEASE }} --info -PremotePublication=true -Pandroid=true ${{ env.PUB_MODE }}
         env:
           CENTRAL_SONATYPE_TOKEN_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
           CENTRAL_SONATYPE_TOKEN_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}

.github/workflows/release.yml

@@ -26,9 +26,9 @@ on:
         type: string
         description: Release number
         required: false
-      zenoh-version:
+      zenoh-flat-jni-version:
         type: string
-        description: Release number of Zenoh
+        description: The zenoh-flat-jni release to build against (must already be on Maven Central for a live run)
         required: false
       branch:
         type: string
@@ -67,29 +67,14 @@ jobs:
         env:
           LIVE_RUN: ${{ inputs.live-run || false }}
           VERSION: ${{ steps.create-release-branch.outputs.version }}
-          BUMP_DEPS_VERSION: ${{ inputs.zenoh-version }}
-          BUMP_DEPS_PATTERN: ${{ inputs.zenoh-version && 'zenoh.*' || '' }}
-          BUMP_DEPS_BRANCH: ${{ inputs.zenoh-version && format('release/{0}', inputs.zenoh-version) || '' }}
+          FLAT_JNI_VERSION: ${{ inputs.zenoh-flat-jni-version }}
           GIT_USER_NAME: eclipse-zenoh-bot
           GIT_USER_EMAIL: eclipse-zenoh-bot@users.noreply.github.com
 
-  publish-jvm:
-    name: Publish JVM package
+  publish:
+    name: Publish to Maven Central
     needs: tag
-    uses: ./.github/workflows/publish-jvm.yml
-    with:
-      snapshot: ${{ !(inputs.live-run || false) }}
-      branch: ${{ needs.tag.outputs.branch }}
-      maven_publish: ${{ !contains(inputs.maven_publish, 'false') }}
-    permissions:
-      contents: read
-      packages: write
-    secrets: inherit
-
-  publish-android:
-    name: Publish Android package
-    needs: tag
-    uses: ./.github/workflows/publish-android.yml
+    uses: ./.github/workflows/publish.yml
     with:
       snapshot: ${{ !(inputs.live-run || false) }}
       branch: ${{ needs.tag.outputs.branch }}
@@ -101,8 +86,12 @@ jobs:
 
   publish-dokka:
     name: Publish documentation
-    needs: [tag, publish-android, publish-jvm]
+    needs: [tag, publish]
     uses: ./.github/workflows/publish-dokka.yml
     with:
       live-run: ${{ inputs.live-run || false }}
       branch: ${{ needs.tag.outputs.branch }}
+    # peaceiris/actions-gh-pages pushes the generated site to the gh-pages
+    # branch, which the default read-only token cannot do.
+    permissions:
+      contents: write