prepare Maven Central-compatible Kotlin publication

[Guardiola31337]

Description

• keep the existing Kotlin GitHub Packages publishing path active
• prepare the Kotlin bindings artifact as a Maven Central-compatible Maven publication with coordinates com.worldcoin:idkit
• add local Maven publishing via publishToMavenLocal
• make Maven Central upload/signing available only through an explicit local Gradle opt-in, so current GitHub release workflows do not require Central credentials yet
• lower the Android library/sample minSdk from 26 to 23 so WLD Android devDebug can consume the artifact

Changes

• keep .github/workflows/publish-kotlin.yml unchanged relative to main; it still publishes Kotlin releases to GitHub Packages
• keep :bindings:publish targeting GitHub Packages by default
• add Vanniktech Maven publish metadata for the Android release publication
• gate Maven Central upload/signing tasks behind -Pidkit.publish.mavenCentral=true
• add an empty -javadoc.jar artifact so the publication shape is compatible with Maven Central without running Android/Kotlin Javadoc generation
• add verifyKotlinNativeLibraries and wire it into Maven publish tasks so publishing fails before artifact creation if expected native .so files are missing
• add CI validation that publishes to mavenLocal(), checks the generated artifact files/POM/AAR native libraries, and dry-runs the Maven Central task graph without credentials
• update the Kotlin README to document GitHub Packages, mavenLocal(), and explicit local Maven Central publish commands

Publishing behavior

Default release behavior remains GitHub Packages:

./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin :bindings:publish

Without -Pidkit.publish.mavenCentral=true, Gradle configures GitHub Packages and Maven local tasks, but does not configure Maven Central upload or signing tasks.

Local Maven publish:

./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin :bindings:publishToMavenLocal

Manual Maven Central publish from a developer machine with Central Portal credentials and signing configured in ~/.gradle/gradle.properties:

./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin \
  -Pidkit.publish.mavenCentral=true \
  :bindings:publishToMavenCentral

To upload and release in one command:

./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin \
  -Pidkit.publish.mavenCentral=true \
  :bindings:publishAndReleaseToMavenCentral

Testing

• ./gradlew :app:assembleDebug from kotlin/Examples/IDKitSampleApp
• ./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin :bindings:tasks --all exposes GitHub Packages and local Maven publish tasks, not Central/signing tasks
• ./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin -Pidkit.publish.mavenCentral=true :bindings:tasks --all exposes publishToMavenCentral, publishAndReleaseToMavenCentral, and signMavenPublication
• ./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin :bindings:publish --dry-run targets publishMavenPublicationToGitHubPackagesRepository and includes verifyKotlinNativeLibraries
• ./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin :bindings:publishToMavenLocal --dry-run
• ./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin -Pidkit.publish.mavenCentral=true :bindings:publishToMavenCentral --dry-run
• ./kotlin/Examples/IDKitSampleApp/gradlew -p kotlin :bindings:verifyKotlinNativeLibraries fails locally when generated jniLibs are absent, with the expected missing-library message
• git diff --check

Not included yet

• The automated release workflow does not upload Kotlin artifacts to Maven Central yet.
• Maven Central GitHub Actions release wiring should be added once Central credentials/signing setup is available in GitHub secrets and the end-to-end release path has been tested.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
idkit-js-example	Ready	Preview, Comment	May 28, 2026 2:25pm

[Takaros999]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Guardiola31337]

@Grimald please take a look when you have a chance 🙏

[Grimald]

@Guardiola31337 PR looks good and is merge-ready.
Optional follow-ups to harden Kotlin publishing:

1. add CI validation for the Maven Central path (publishToMavenLocal, artifact shape checks, etc.),
2. add a publish preflight that fails fast if required native .so artifacts are missing,
3. centralize the com.vanniktech.maven.publish plugin version in root plugin management/version catalog.

But I'm not a codeowner =((

[Guardiola31337]

Thanks for the review. Addressed the two hardening items that make sense in this PR:

• Added credentials-free CI validation for the Kotlin Maven publication: :bindings:publishToMavenLocal, generated artifact/POM checks, AAR native library checks for all expected ABIs, and a Maven Central dry-run with -Pidkit.publish.mavenCentral=true.
• Added a Gradle preflight task, verifyKotlinNativeLibraries, wired into Maven publish tasks so publishing fails fast if any expected libidkit.so is missing.

Kept actual Maven Central upload out of the release workflow for now because Central credentials/signing are not available in GitHub secrets yet. Leaving plugin-version centralization as a follow-up since :bindings is resolved from both the Kotlin root and the sample app root.

[Guardiola31337]

@Takaros999 fixed the conflicts, ready for another round of 👀

[Takaros999]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".