Migrate build infrastructure from Gradle to Maven

[ramsessanchez]

Summary

Migrates the build system from Gradle to Maven while preserving all build behaviors, and moves the CI/CD pipelines off Personal Access Token (PAT) usage. Uses microsoftgraph/msgraph-sdk-java#2613 as the baseline, adapted for core-specific concerns (SpotBugs, JaCoCo, SonarCloud).

New Maven build

• pom.xml with all dependencies (from gradle/dependencies.gradle), compiler settings (Java 1.8 main / 17 tests, -parameters), jar manifest (Automatic-Module-Name: com.microsoft.graph.core), javadoc/source jars, JaCoCo, SpotBugs (spotBugsExcludeFilter.xml), SonarCloud, and a GPG signing profile
• Maven wrapper (mvnw/mvnw.cmd/.mvn/, Maven 3.9.9) replacing the Gradle wrapper

CI/CD pipeline updates (PAT-less)

• gradle-build.yml -> maven-build.yml (JDK-latest verify + JDK-8 compile jobs)
• codeql-analysis.yml and sonarcloud.yml updated to Maven
• ADO ci-build.yml: mvnw install/deploy -Psigning, GPG import, settings.xml, and MavenAuthenticate@0 instead of ARTIFACTS_PAT
• ADO daily-ci-build.yml: Maven@4 + network-isolated feed mirror + MavenAuthenticate@0

Config updates

• dependabot.yml: maven ecosystem for root, gradle kept for /android
• .gitignore: Maven wrapper/target entries
• release-please-config.json: XML xpath updater for pom.xml version (dropped gradle.properties)
• devx.yml, scripts/getLatestVersion.ps1 -> read from pom.xml
• scripts/validatePackageContents.ps1 + release assets: dropped Gradle-only .module metadata

Android sub-project

• Kept as a standalone Gradle project (no Maven equivalent for AGP); dependencies inlined into android/build.gradle (shared gradle/dependencies.gradle removed)

Removed

• Root Gradle files (build.gradle, settings.gradle, gradle.properties, gradlew, wrapper)
• java-8/ sub-project (Java 8 compat now verified via Maven source/target 1.8 + JDK 8 CI job)

Notes / deviations from baseline

• Tests compile at Java 17 (JUnit 6 requires it; Gradle only constrained compileJava to 1.8, not tests)
• .module checks removed since Maven does not emit Gradle module metadata

Verification

• ./mvnw verify -> BUILD SUCCESS: 79 tests pass, SpotBugs clean, JaCoCo report generated
• JAR, javadoc JAR, sources JAR built; manifest contains Automatic-Module-Name: com.microsoft.graph.core

[Copilot]

Pull request overview

This PR migrates the repository’s primary build and CI/CD infrastructure from Gradle to Maven (via Maven Wrapper), while also updating GitHub Actions and Azure DevOps pipelines to remove PAT-based authentication and preserve existing quality gates (SpotBugs, JaCoCo, SonarCloud).

Changes:

• Replaces the root Gradle build with a full Maven pom.xml + Maven Wrapper, including JaCoCo, SpotBugs, SonarCloud, and signing profile support.
• Updates GitHub Actions and Azure DevOps pipelines to build/test/publish via Maven and use PAT-less feed authentication.
• Keeps the Android sub-project on Gradle while removing shared Gradle dependency management from the root.

Reviewed changes

Copilot reviewed 28 out of 32 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
spotBugsExcludeFilter.xml	Adds a SpotBugs suppression entry used by the Maven SpotBugs configuration.
settings.gradle	Removes Gradle settings as part of the root Gradle decommissioning.
scripts/validatePackageContents.ps1	Removes Gradle-only .module artifact expectations from package validation.
scripts/getLatestVersion.ps1	Switches version discovery from gradle.properties to pom.xml.
release-please-config.json	Updates release-please to bump pom.xml version via XML xpath instead of Gradle properties.
pom.xml	Introduces the full Maven build definition (deps, plugins, reporting/signing configuration).
mvnw.cmd	Adds Maven Wrapper for Windows.
mvnw	Adds Maven Wrapper for POSIX shells.
java-8/settings.gradle	Removes the old Java 8 Gradle subproject settings.
java-8/gradle.properties	Removes the old Java 8 Gradle subproject properties.
java-8/build.gradle	Removes the old Java 8 Gradle subproject build file.
java-8/.gitignore	Removes now-obsolete ignore rules for the deleted Java 8 subproject build.
gradlew.bat	Removes the Gradle wrapper for Windows from the root build.
gradlew	Removes the Gradle wrapper for POSIX shells from the root build.
gradle/wrapper/gradle-wrapper.properties	Removes the Gradle wrapper configuration.
gradle/dependencies.gradle	Removes shared Gradle dependency management (now represented in pom.xml).
gradle.properties	Removes Gradle property-based versioning and feed credential placeholders.
devx.yml	Points dependency discovery at pom.xml instead of Gradle dependency file.
build.gradle	Removes the root Gradle build definition.
android/lint.xml	Adds lint suppressions related to intentionally deferred Android dependency major bumps.
android/build.gradle	Inlines dependency declarations now that shared Gradle deps file is removed.
.mvn/wrapper/maven-wrapper.properties	Adds Maven Wrapper distribution + checksum configuration.
.gitignore	Updates ignore rules for Maven build output and ensures wrapper jar can be committed.
.github/workflows/sonarcloud.yml	Updates SonarCloud workflow to use Maven and Maven caching.
.github/workflows/maven-build.yml	Adds a Maven-based GitHub Actions build workflow (JDK latest + JDK 8 compile job).
.github/workflows/gradle-build.yml	Removes the Gradle-based GitHub Actions workflow.
.github/workflows/codeql-analysis.yml	Updates CodeQL build step to Maven and switches caching to Maven.
.github/dependabot.yml	Switches root updates to Maven ecosystem; keeps Android on Gradle and adjusts ignore rules.
.azure-pipelines/daily-ci-build.yml	Updates the network-isolated daily build to Maven with feed mirroring + PAT-less auth.
.azure-pipelines/ci-build.yml	Updates CI build/release staging steps to Maven (install/deploy/signing) and removes .module handling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud