Build Android against the published protocol by default

[kiftio]

What changes are you making?

Android previously compiled the protocol from local source while its published POM pointed consumers at a separate Maven artifact. That allowed Kit to ship references to classes missing from its declared dependency.

The SDK and Android sample now compile against the pinned Maven Central protocol artifact in normal builds, CI, and releases. Joint development opts into source with dev android local <command> or -PuseLocalProtocol=true. Remote Kit publication rejects local mode, while React Native's explicit --local flow can still publish both artifacts to Maven Local.

The protocol release version and Kit's dependency pin are separate so a protocol release PR can merge before Kit adopts the new artifact. Protocol tests and lint run independently, and Kit publication runs unit tests and API checks before uploading.

A small :lib:verifyPublishedProtocol task also requires release and unit-test classpaths to resolve the declared ECP module at exactly the catalog-pinned version. It catches project substitution and version drift introduced by dependency resolution, runs automatically with SDK unit tests and remote publication, and skips explicit local mode. This retains the useful safeguard from #832 without adding a fixture framework or another build-mode toggle.

Release process

For a feature spanning all three packages, the order is ECP → Android Kit → React Native:

1. Release ECP to Maven Central. Bump embeddedCheckoutProtocolAndroid with the protocol changes and API baseline. Keep Kit's embeddedCheckoutProtocolAndroidDependency at the existing published version while this PR passes CI, merges, and releases.
2. Adopt ECP and release Android Kit. Once the protocol artifact and metadata are available, update Kit's ECP dependency pin, make the SDK changes, and bump checkoutKitAndroid. Run normal SDK/sample CI and API checks against that published ECP version, then merge and publish Kit to Maven Central.
3. Adopt Android Kit and release RN. Once Kit is available, update checkoutKit.nativeSdkVersions.android and the RN package's own version. Run normal RN Android tests and the sample build against the published Kit and its transitive ECP dependency, plus the other required RN checks. Merge and publish RN to npm. RN does not need its own ECP pin.

At each stage, use the Release package workflow's dry run and draft release flow. Wait for actual registry availability before verifying the next package; a GitHub release/tag alone is insufficient. The workflows do not automatically sequence the stages. The RN npm publish job builds/packs JavaScript and does not rerun Android compilation, so RN Android CI must pass before release.

Only changed dependencies need new releases: Android-only changes can keep the ECP pin, and RN-only changes can keep both native pins. Update RN's iOS pin only when needed, after its required Swift release is available on CocoaPods. Package versions remain independent.

This waterfall makes each package a consumer of the published dependency it declares. It catches missing API during compilation, gives each layer an explicit version boundary, and preserves ECP as a shared transitive dependency rather than embedding duplicate protocol classes. The cost is upstream publication time and a downstream CI run at each adoption. Local overrides support development across stacked branches, but normal CI must pass against published artifacts before those downstream PRs merge.

The coordinated release guide, RN release guide, Android README, and PR release checklists now document this process.

How to test

Verified locally:

• Published dependency: 504 SDK tests, 99 sample tests, SDK API check, release AAR, and sample debug build passed.
• Protocol source: 50 tests passed through dev protocol test kotlin.
• Local override: dev android local api check passed for Kit and protocol.
• SDK and sample detekt tasks passed.
• Publication guard: an attempted local-mode publication to an isolated file repository was rejected before uploading any artifacts.
• Resolved-dependency guard: temporary Gradle init scripts against the real Android project confirmed rejection of forced version drift on all four release/unit-test classpaths and of project substitution. Tests also exercised the guard through the actual unit-test and publication tasks.
• Local-mode compatibility: verification skipped as expected, remote publication remained blocked, and Kit plus ECP still published successfully to an isolated Maven Local repository.
• React Native local publishing produced both artifacts in a temporary Maven Local repository with the expected protocol dependency.
• Release-version regression test passed: protocol publication can advance while Kit still references its older dependency.
• Workflow YAML parsing, shell syntax, React Native local-default checks, and git diff --check passed.
• Added documentation links and anchors were checked against repository files.

Before you merge

• Added a regression test for independent protocol release and dependency versions.
• Updated contributor, Android, and RN release documentation and the PR release checklists.
• CI passes.

[github-actions]

React Native — Coverage Report

Lines	Statements	Branches	Functions
	90.97% (363/399)	87.29% (213/244)	100% (92/92)

[github-actions]

Package Size

Platform	Artifact	Base	Head	Delta
React Native	npm tarball	119.0 KiB	119.0 KiB	0 B
Android	release AAR	406.7 KiB	406.7 KiB	0 B

React Native file breakdown

File	Base	Head	Delta
node_modules/@shopify/checkout-kit-protocol/src/generated/Models.ts	108.7 KiB	108.7 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/Models.d.ts	73.1 KiB	73.1 KiB	0 B
android/src/main/java/com/shopify/reactnative/checkoutkit/ShopifyCheckoutKitModule.java	16.2 KiB	16.2 KiB	0 B
ios/ShopifyCheckoutKit.swift	16.1 KiB	16.1 KiB	0 B
ios/AcceleratedCheckoutButtons.swift	14.1 KiB	14.1 KiB	0 B
src/components/AcceleratedCheckoutButtons.tsx	13.0 KiB	13.0 KiB	0 B
src/index.ts	12.7 KiB	12.7 KiB	0 B
lib/commonjs/index.js	12.4 KiB	12.4 KiB	0 B
lib/commonjs/components/AcceleratedCheckoutButtons.js	11.4 KiB	11.4 KiB	0 B
src/index.d.ts	11.3 KiB	11.3 KiB	0 B
lib/commonjs/components/AcceleratedCheckoutButtons.js.map	10.4 KiB	10.4 KiB	0 B
lib/module/index.js	10.4 KiB	10.4 KiB	0 B
lib/module/components/AcceleratedCheckoutButtons.js	10.2 KiB	10.2 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolNotifications.ts	9.5 KiB	9.5 KiB	0 B
lib/module/components/AcceleratedCheckoutButtons.js.map	9.1 KiB	9.1 KiB	0 B
lib/module/index.js.map	8.1 KiB	8.1 KiB	0 B
src/present-dispatcher.ts	8.0 KiB	8.0 KiB	0 B
lib/commonjs/index.js.map	7.9 KiB	7.9 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolRenameMap.ts	7.8 KiB	7.8 KiB	0 B
node_modules/@shopify/checkout-kit-protocol/src/generated/ProtocolNotifications.d.ts	7.6 KiB	7.6 KiB	0 B
…and 117 smaller files

Android file breakdown

File	Base	Head	Delta
classes.jar	433.2 KiB	433.2 KiB	0 B
res/layout/checkout_view_content.xml	2.6 KiB	2.6 KiB	0 B
res/layout/checkout_sheet_content.xml	2.0 KiB	2.0 KiB	0 B
res/values/values.xml	1.3 KiB	1.3 KiB	0 B
R.txt	1.2 KiB	1.2 KiB	0 B
AndroidManifest.xml	922 B	922 B	0 B
proguard.txt	798 B	798 B	0 B
res/drawable/close.xml	431 B	431 B	0 B
res/menu/checkout_menu.xml	354 B	354 B	0 B
META-INF/com/android/build/gradle/aar-metadata.properties	157 B	157 B	0 B

Measured from the PR base SHA and PR head SHA. The file breakdown shows uncompressed sizes within each package artifact, so individual files do not sum to the compressed artifact total. This comment reports package artifact sizes only; it is not a final app binary-size report.

[bitrise]

Install this build

Open Tophat, select your target device, then click Install. Links open on the Mac running Tophat.

SDK	Install
React Native	Install with Tophat
Kotlin	Install with Tophat

Checkout Kit E2E results

Status	Tags	Target	Platform	OS version tag	Device
✅	launch, checkout-presentation, checkout-completion, buyer-identity	react-native	ios	latest	iPhone 15 iOS 27 Beta
✅	launch, checkout-presentation, checkout-completion, buyer-identity	react-native	android	latest	Google Pixel 9 Android 17.0
✅	launch, checkout-presentation, checkout-completion, buyer-identity, preload	kotlin	android	latest	Google Pixel 9 Android 17.0