Publish keyattestation as a Maven artifact and set up release workflow.

.github/workflows/gradle.yml

@@ -1,3 +1,17 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 name: Gradle Build and Test
 
 on:
@@ -6,16 +20,18 @@ on:
   pull_request:
     branches: [main]
 
+permissions: read-all
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
         with:
           distribution: "temurin"
           java-version: 21
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
       - name: Build
         run: ./gradlew build
       - name: Test

.github/workflows/release.yml

@@ -0,0 +1,75 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions: read-all
+
+jobs:
+  build-maven-repo:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
+        with:
+          distribution: "temurin"
+          java-version: 21
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
+      - name: "Set environment variables"
+        run: |
+          echo "ORG_GRADLE_PROJECT_KeyAttestationMavenRepo=$GITHUB_WORKSPACE/keyattestation_m2repo" >> "$GITHUB_ENV"
+      - name: Build Maven repo
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: ./gradlew -PkeyAttestationReleaseVersion="$REF_NAME" publishAllPublicationsToLocalDirRepository
+
+      - name: Upload
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: keyattestation_m2repo
+          path: keyattestation_m2repo
+
+  upload-release:
+    runs-on: ubuntu-latest
+    needs:
+      - build-maven-repo
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          submodules: 'recursive'
+      # Download all artifacts
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+
+      - name: Zip releases
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          zip -q -r "keyattestation_m2repo-$REF_NAME.zip" keyattestation_m2repo/
+
+      - name: Upload release artifacts
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          gh release upload "$REF_NAME" \
+          "keyattestation_m2repo-$REF_NAME.zip"

build.gradle.kts

@@ -17,6 +17,31 @@
 plugins {
   id("com.adarshr.test-logger") version "4.0.0"
   id("org.jetbrains.kotlin.jvm") version "2.2.0"
+  `maven-publish`
+}
+
+group = "com.android.keyattestation"
+
+version =
+  project.findProperty("keyAttestationReleaseVersion")?.toString()?.removePrefix("v") ?: "0.9.0"
+
+publishing {
+  publications {
+    create<MavenPublication>("mavenJava") {
+      from(components["java"])
+      groupId = "com.android.keyattestation"
+      artifactId = "keyattestation"
+    }
+  }
+  repositories {
+    maven {
+      name = "localDir"
+      url =
+        uri(
+          project.findProperty("KeyAttestationMavenRepo") ?: layout.buildDirectory.dir("repository")
+        )
+    }
+  }
 }
 
 repositories {
@@ -58,20 +83,19 @@ tasks {
 
 val generatedSourcesDir = layout.buildDirectory.dir("generated")
 
-val googleTrustAnchors by
-  tasks.registering {
-    val jsonFile = file("roots.json")
-    val json = jsonFile.readText()
-    val generatedFile = generatedSourcesDir.get().file("main/kotlin/GoogleTrustAnchors.kt")
+val googleTrustAnchors by tasks.registering {
+  val jsonFile = file("roots.json")
+  val json = jsonFile.readText()
+  val generatedFile = generatedSourcesDir.get().file("main/kotlin/GoogleTrustAnchors.kt")
 
-    inputs.files(jsonFile)
-    outputs.file(generatedFile)
+  inputs.files(jsonFile)
+  outputs.file(generatedFile)
 
-    doLast {
-      generatedFile
-        .getAsFile()
-        .writeText(
-          """
+  doLast {
+    generatedFile
+      .getAsFile()
+      .writeText(
+        """
         package com.android.keyattestation.verifier
 
         import com.android.keyattestation.verifier.asX509Certificate
@@ -92,15 +116,14 @@ val googleTrustAnchors by
           }
         }
         """
-        )
-    }
+      )
   }
+}
 
-val generateSources by
-  tasks.registering {
-    outputs.dir(generatedSourcesDir)
-    dependsOn(tasks.named("googleTrustAnchors"))
-  }
+val generateSources by tasks.registering {
+  outputs.dir(generatedSourcesDir)
+  dependsOn(tasks.named("googleTrustAnchors"))
+}
 
 sourceSets { main { kotlin.srcDir(generateSources) } }
 

keyattestation.pp

@@ -0,0 +1,32 @@
+import '//releasetools/rapid/workflows/rapid.pp' as rapid
+
+vars = rapid.create_vars() {}
+
+artifact_id = vars.process_arguments.get('artifact_id', [''])[0]
+auth_token = vars.process_arguments.get('auth_token', [''])[0]
+dry_run = vars.process_arguments.get('dry_run', [
+                                       true,
+                                     ])[0]
+
+task_deps = [
+  'gmaven.sign_artifacts': [],
+  'gmaven.stage': ['gmaven.sign_artifacts'],
+  'gmaven.publish': ['gmaven.stage'],
+]
+
+task_properties = [
+  'gmaven.sign_artifacts': [
+    'gh_artifacts': 'android:keyattestation:' + artifact_id + ':' + auth_token,
+    'output_field_name': 'gmaven_signed_zip',
+  ],
+  'gmaven.stage': [
+    'gfile_paths': '%(candidate_custom_field_gmaven_signed_zip)s',
+  ],
+  'gmaven.publish': [
+    'dry_run': dry_run,
+  ],
+]
+
+workflow keyattestation_release = rapid.workflow([task_deps, task_properties]) {
+  vars = @vars
+}

keyattestation_noop_cc.pp

@@ -0,0 +1,14 @@
+import '//releasetools/rapid/workflows/rapid.pp' as rapid
+
+vars = rapid.create_vars() {}
+
+task_deps = [
+  'integrate': ['start'],
+  'integrate_log': ['integrate'],
+]
+
+task_properties = []
+
+workflow create_candidate = rapid.workflow([task_deps, task_properties]) {
+  vars = @vars
+}