Migrate build infrastructure from Gradle to Maven

.azure-pipelines/ci-build.yml

@@ -65,29 +65,62 @@ extends:
                   Copy-Item $(downloadLocalProperties.secureFilePath) local.properties -Verbose
                 displayName: Copy secring and 'local.properties'
 
-              - script: ./gradlew --no-daemon publishToMavenLocal -PmavenCentralPublishingEnabled=true -PmavenCentralSnapshotArtifactSuffix=""
-                displayName: Publish to local Maven for verification
-                condition: contains(variables['build.sourceBranch'], 'refs/tags/v')
+              - pwsh: |
+                  # maven-gpg-plugin signs via the local gpg keyring, so the key from
+                  # secring.gpg must be imported into gpg before signing can succeed.
+                  gpg --batch --import secring.gpg
+                displayName: Import GPG signing key
 
-              - script: ./gradlew --no-daemon publishToMavenLocal -PmavenCentralPublishingEnabled=true
-                displayName: Publish to local Maven for verification
-                condition: not(contains(variables['build.sourceBranch'], 'refs/tags/v'))
+              - pwsh: |
+                  $props = Get-Content local.properties -Raw
+                  $keyId = ($props | Select-String -Pattern 'signing\.keyId=(.+)').Matches.Groups[1].Value
+                  $keyPassword = ($props | Select-String -Pattern 'signing\.password=(.+)').Matches.Groups[1].Value
+
+                  $settingsXml = @"
+                  <settings>
+                    <mirrors>
+                      <mirror>
+                        <id>GraphDeveloperExperiences_Public</id>
+                        <mirrorOf>*</mirrorOf>
+                        <url>https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/maven/v1</url>
+                      </mirror>
+                    </mirrors>
+                    <profiles>
+                      <profile>
+                        <id>signing</id>
+                        <properties>
+                          <gpg.keyname>$keyId</gpg.keyname>
+                          <gpg.passphrase>$keyPassword</gpg.passphrase>
+                        </properties>
+                      </profile>
+                    </profiles>
+                  </settings>
+                  "@
+                  $settingsDir = Join-Path $HOME ".m2"
+                  New-Item -ItemType Directory -Path $settingsDir -Force | Out-Null
+                  $settingsXml | Set-Content (Join-Path $settingsDir "settings.xml") -Encoding UTF8
+                displayName: Configure Maven settings
+
+              - task: MavenAuthenticate@0
+                displayName: Authenticate to Azure Artifacts feed (PAT-less)
+                inputs:
+                  artifactsFeeds: 'GraphDeveloperExperiences_Public'
 
-              - script: ./gradlew --no-daemon publishMavenPublicationToADORepository -PmavenCentralPublishingEnabled=true -PmavenCentralSnapshotArtifactSuffix=""
-                displayName: Publish to local Maven ADO for ESRP
-                condition: contains(variables['build.sourceBranch'], 'refs/tags/v')
+              - script: ./mvnw install -Psigning --no-transfer-progress
+                displayName: Publish to local Maven for verification
 
-              - script: ./gradlew --no-daemon publishMavenPublicationToADORepository -PmavenCentralPublishingEnabled=true
-                displayName: Publish to local Maven ADO for ESRP
-                condition: not(contains(variables['build.sourceBranch'], 'refs/tags/v'))
+              - script: ./mvnw deploy -Psigning --no-transfer-progress -DaltDeploymentRepository=ADO::default::file://$(Build.SourcesDirectory)/target/staging-deploy
+                displayName: Stage artifacts for ESRP
 
               - pwsh: |
-                  $contents = Get-Content gradle.properties -Raw
-                  $major = $contents | Select-String -Pattern 'mavenMajorVersion\s*=\s*([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
-                  $minor = $contents | Select-String -Pattern 'mavenMinorVersion\s*=\s*([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
-                  $patch = $contents | Select-String -Pattern 'mavenPatchVersion\s*=\s*([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
-                  $snapshot_suffix = if ($Env:BRANCH_NAME.StartsWith('refs/tags/v')) { '' } else { '-SNAPSHOT' }
-                  $version = "$major.$minor.$patch$snapshot_suffix"
+                  $pomXml = [xml](Get-Content pom.xml -Raw)
+                  $ns = New-Object System.Xml.XmlNamespaceManager($pomXml.NameTable)
+                  $ns.AddNamespace('m', $pomXml.DocumentElement.NamespaceURI)
+                  $version = $pomXml.SelectSingleNode('/m:project/m:version', $ns).InnerText
+                  # If version contains -SNAPSHOT and we're on a tag, strip it
+                  if ($Env:BRANCH_NAME.StartsWith('refs/tags/v')) {
+                    $version = $version -replace '-SNAPSHOT$', ''
+                  }
                   echo "Current version is $version"
                   echo "##vso[task.setvariable variable=PACKAGE_VERSION;]$version"
                 displayName: Get current version
@@ -100,7 +133,7 @@ extends:
                 displayName: Inspect contents of local Maven cache
 
               - pwsh: |
-                  $packageFullPath = Join-Path -Path "./" -ChildPath "build/publishing-repository/com/microsoft/graph/microsoft-graph-core" -AdditionalChildPath "$(PACKAGE_VERSION)"
+                  $packageFullPath = Join-Path -Path "./target/staging-deploy" -ChildPath "com/microsoft/graph/microsoft-graph-core" -AdditionalChildPath "$(PACKAGE_VERSION)"
                   echo "Package full path: $packageFullPath"
                   echo "##vso[task.setvariable variable=PACKAGE_PATH;]$packageFullPath"
                 displayName: Get the package full path
@@ -176,16 +209,6 @@ extends:
                           $(Pipeline.Workspace)/**/*.pom.asc.sha1
                           $(Pipeline.Workspace)/**/*.pom.asc.sha256
                           $(Pipeline.Workspace)/**/*.pom.asc.sha512
-                          $(Pipeline.Workspace)/**/*.module
-                          $(Pipeline.Workspace)/**/*.module.md5
-                          $(Pipeline.Workspace)/**/*.module.sha1
-                          $(Pipeline.Workspace)/**/*.module.sha256
-                          $(Pipeline.Workspace)/**/*.module.sha512
-                          $(Pipeline.Workspace)/**/*.module.asc
-                          $(Pipeline.Workspace)/**/*.module.asc.md5
-                          $(Pipeline.Workspace)/**/*.module.asc.sha1
-                          $(Pipeline.Workspace)/**/*.module.asc.sha256
-                          $(Pipeline.Workspace)/**/*.module.asc.sha512
 
                         addChangeLog: false
                         action: edit

.azure-pipelines/daily-ci-build.yml

@@ -43,26 +43,47 @@ extends:
               - checkout: self
                 submodules: recursive
 
-              - script: |
-                  sed -i "/com.github.spotbugs/d" build.gradle
-                  sed -i "/org.sonarqube/d" build.gradle
-                  sed -i "/spotbugsMain/,/^}/d" build.gradle
-                  sed -i "/spotbugsTest/,/^}/d" build.gradle
-                  sed -i "/sonarqube {/,/^}/d" build.gradle
-                  sed -i "/mavenCentral()/d" build.gradle
-                  sed -i "/gradlePluginPortal()/d" settings.gradle
-                  sed -i "/mavenCentral()/d" settings.gradle
-                displayName: Strip plugins and public repos for network-isolated build
+              - task: JavaToolInstaller@1
+                inputs:
+                  versionSpec: '17'
+                  jdkArchitectureOption: 'x64'
+                  jdkSourceOption: 'PreInstalled'
+
+              - pwsh: |
+                  # Route all Maven resolution through the Azure Artifacts feed (Maven Central upstream)
+                  # so the network-isolated build never reaches the public internet. Credentials for the
+                  # mirror are injected PAT-less by the MavenAuthenticate task below; the mirror <id> must
+                  # match the <server> id it generates (the feed name).
+                  $settingsXml = @"
+                  <settings>
+                    <mirrors>
+                      <mirror>
+                        <id>GraphDeveloperExperiences_Public</id>
+                        <mirrorOf>*</mirrorOf>
+                        <url>https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/maven/v1</url>
+                      </mirror>
+                    </mirrors>
+                  </settings>
+                  "@
+                  $settingsDir = Join-Path $HOME ".m2"
+                  New-Item -ItemType Directory -Path $settingsDir -Force | Out-Null
+                  $settingsXml | Set-Content (Join-Path $settingsDir "settings.xml") -Encoding UTF8
+                displayName: Configure Maven mirror for network-isolated build
+
+              - task: MavenAuthenticate@0
+                displayName: Authenticate to Azure Artifacts feed (PAT-less)
+                inputs:
+                  artifactsFeeds: 'GraphDeveloperExperiences_Public'
 
-              - task: Gradle@4
+              - task: Maven@4
                 displayName: Build and Test SDK
                 inputs:
-                  gradleWrapperFile: 'gradlew'
-                  workingDirectory: '$(Build.SourcesDirectory)'
-                  tasks: 'assemble test'
-                  options: '--no-daemon -PGraphDeveloperExperiencesPublicPassword=$(ARTIFACTS_PAT)'
+                  mavenPomFile: 'pom.xml'
+                  goals: 'verify'
+                  options: '--no-transfer-progress'
                   publishJUnitResults: true
-                  testResultsFiles: '**/TEST-*.xml'
+                  testResultsFiles: '**/surefire-reports/TEST-*.xml'
                   javaHomeOption: 'JDKVersion'
                   jdkVersionOption: '1.17'
                   jdkArchitectureOption: 'x64'
+                  mavenOptions: '-Xmx3072m'

.github/dependabot.yml

@@ -1,13 +1,16 @@
 version: 2
 updates:
-- package-ecosystem: gradle
-  directories:
-    - "/"
-    - "/java-8"
+- package-ecosystem: maven
+  directory: "/"
   schedule:
     interval: daily
     time: "09:00" # 9am UTC
   open-pull-requests-limit: 10
+  ignore:
+    # jakarta.annotation-api 3.x is compiled to Java 11 bytecode, which is
+    # incompatible with this library's Java 8 baseline. Stay on the 2.x line.
+    - dependency-name: "jakarta.annotation:jakarta.annotation-api"
+      update-types: ["version-update:semver-major"]
   groups:
     kiota-dependencies:
       patterns:
@@ -24,21 +27,11 @@ updates:
     interval: daily
     time: "10:00" # 10am UTC. After core dependencies are updated to prevent duplicates.
   open-pull-requests-limit: 10
-  groups:
-    kiota-dependencies:
-      patterns:
-        - "*kiota*"
-    junit-dependencies:
-      patterns:
-        - "*junit*"
-    open-telemetry:
-      patterns:
-        - "*opentelemetry*"
-- package-ecosystem: maven
-  directory: "/"
-  schedule:
-    interval: daily
-  open-pull-requests-limit: 10
+  ignore:
+    # jakarta.annotation-api 3.x is compiled to Java 11 bytecode, which is
+    # incompatible with this library's Java 8 baseline. Stay on the 2.x line.
+    - dependency-name: "jakarta.annotation:jakarta.annotation-api"
+      update-types: ["version-update:semver-major"]
   groups:
     kiota-dependencies:
       patterns:

.github/workflows/codeql-analysis.yml

@@ -49,7 +49,7 @@ jobs:
       with:
         java-version: 21
         distribution: 'temurin'
-        cache: gradle
+        cache: maven
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
@@ -75,10 +75,8 @@ jobs:
     #   If the Autobuild fails above, remove it and uncomment the following three lines.
     #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
 
-    - name: Grant execute permission for gradlew
-      run: chmod +x gradlew
-    - name: Build with Gradle
-      run: ./gradlew build
+    - name: Build with Maven
+      run: ./mvnw compile --no-transfer-progress -DskipTests
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v4

.github/workflows/maven-build.yml

@@ -0,0 +1,51 @@
+name: Maven Build
+
+on:
+  pull_request:
+    branches: [main, support/2.x.x]
+  workflow_dispatch:
+
+jobs:
+  build-java-latest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Set up JDK
+        uses: actions/setup-java@v5
+        with:
+          java-version: 21
+          distribution: 'temurin'
+          cache: maven
+      - name: Build with Maven
+        run: ./mvnw verify --no-transfer-progress
+      - name: Upload Unit Test Results
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: UnitTests
+          path: |
+            target/surefire-reports/**
+      - name: Upload a Build Artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: drop
+          path: |
+            target/*.jar
+            pom.xml
+            mvnw
+            mvnw.cmd
+            .mvn/**
+            scripts/**
+
+  build-java-8:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Set up JDK
+        uses: actions/setup-java@v5
+        with:
+          java-version: 8
+          distribution: 'temurin'
+          cache: maven
+      - name: Build with Java 8
+        run: ./mvnw compile --no-transfer-progress

.github/workflows/sonarcloud.yml

@@ -34,20 +34,14 @@ jobs:
         with:
           java-version: 21
           distribution: 'temurin'
-          cache: gradle
+          cache: maven
       - name: Cache SonarCloud packages
         uses: actions/cache@v5
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
-      - name: Cache Gradle packages
-        uses: actions/cache@v5
-        with:
-          path: ~/.gradle/caches
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
-          restore-keys: ${{ runner.os }}-gradle
       - name: Build and analyze
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
-        run: ./gradlew build sonarqube --info
+        run: ./mvnw verify sonar:sonar --no-transfer-progress -Dsonar.token=$SONAR_TOKEN

.gitignore

@@ -20,9 +20,12 @@
 
 # virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
 hs_err_pid*
-/.gradle/
-/build/
-/bin/
+
+# Maven
+/target/
+
+# Maven wrapper
+!.mvn/wrapper/maven-wrapper.jar
 
 #Eclipse
 .project
@@ -33,7 +36,5 @@ hs_err_pid*
 *.iml
 .idea/
 
-# Maven
-/target/
 local.properties
 *.gpg

.mvn/wrapper/maven-wrapper.properties

@@ -0,0 +1,4 @@
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
+distributionSha256Sum=4ec3f26fb1a692473aea0235c300bd20f0f9fe741947c82c1234cefd76ac3a3c
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
+wrapperSha256Sum=3d8f20ce6103913be8b52aef6d994e0c54705fb527324ceb9b835b338739c7a8