Merge branch 'feature/2025-08-plugins' into maplibre/feature/2025-08-plugins

Author: AtlasProgramming

.github/workflows/android-ci.yml

@@ -12,6 +12,10 @@ on:
     branches:
       - "*"
 
+permissions:
+  contents: write
+  actions: write
+
 concurrency:
   # cancel jobs on PRs only
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -30,7 +34,7 @@ jobs:
       - name: Get all Android files that have changed
         if: github.event_name != 'workflow_dispatch'
         id: changed-files
-        uses: tj-actions/changed-files@v46
+        uses: step-security/changed-files@3dbe17c78367e7d60f00d78ae6781a35be47b4a1
         with:
           files_yaml_from_source_file: .github/changed-files.yml
 
@@ -352,7 +356,7 @@ jobs:
       - name: VERSION file changed
         if: github.ref == 'refs/heads/main' && github.event_name == 'push'
         id: version-file-android-changed
-        uses: tj-actions/changed-files@v46
+        uses: step-security/changed-files@3dbe17c78367e7d60f00d78ae6781a35be47b4a1
         with:
           files: platform/android/VERSION
 

.github/workflows/android-device-test.yml

@@ -1,10 +1,7 @@
 name: android-device-test
 
 on:
-  workflow_run:
-    workflows: [android-ci]
-    types:
-      - completed
+  workflow_dispatch:
 
 permissions:
   id-token: write         # needed for AWS

.github/workflows/android-release.yml

@@ -3,6 +3,9 @@ name: android-release
 on:
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   android-create-release:
     runs-on: ubuntu-24.04
@@ -52,7 +55,7 @@ jobs:
         id: create_release
         uses: actions/create-release@v1
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.MAPLIBRE_NATIVE_PRIVATE_TOKEN }}
         with:
           tag_name: ${{ steps.prepare_release.outputs.version_tag }}
           release_name: ${{steps.prepare_release.outputs.version_tag }}
@@ -62,7 +65,7 @@ jobs:
 
   android-build-and-upload-release:
     needs: android-create-release
-    runs-on: MapLibre_Native_Ubuntu_24_04_x84_16_core
+    runs-on: ubuntu-24.04
     defaults:
       run:
         working-directory: platform/android
@@ -133,35 +136,23 @@ jobs:
           asset_name: debug-symbols-maplibre-android-${{ matrix.RENDERER }}-${{ env.buildtype }}-${{ needs.android-create-release.outputs.version_tag }}.tar.gz
           asset_content_type: application/gzip
 
-      - name: Prepare MavenCentral release
+      - name: Publish to Github
         env:
-          GPG_KEY_CONTENTS: ${{ secrets.GPG_KEY_CONTENTS }}
-        run: |
-          echo "${GPG_KEY_CONTENTS}" | base64 -d > signing-key.gpg
-        shell: bash
-
-      - name: Publish to MavenCentral
+          GITHUB_TOKEN: ${{ secrets.MAPLIBRE_NATIVE_PRIVATE_TOKEN }}
         run: |
-          renderer=${{ matrix.RENDERER }}
-          if [ "$renderer" = "opengl" ]; then
-            ./gradlew :MapLibreAndroid:publishOpengl${{ env.buildtype }}PublicationToSonatypeRepository closeAndReleaseSonatypeStagingRepository
-            ./gradlew :MapLibreAndroid:publishDefault${{ env.buildtype }}PublicationToSonatypeRepository closeAndReleaseSonatypeStagingRepository
-          else
-            ./gradlew :MapLibreAndroid:publishVulkan${{ env.buildtype }}PublicationToSonatypeRepository closeAndReleaseSonatypeStagingRepository
-          fi
-        env:
-          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
-          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
-          SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
-          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-          SONATYPE_STAGING_PROFILE_ID: ${{ secrets.SONATYPE_STAGING_PROFILE_ID }}
+            renderer=${{ matrix.RENDERER }}
+            if [ "$renderer" = "opengl" ]; then
+              ./gradlew :MapLibreAndroid:publishDefault${{ env.buildtype }}PublicationToGithubPackagesRepository
+            else
+              ./gradlew :MapLibreAndroid:publishVulkan${{ env.buildtype }}PublicationToGithubPackagesRepository
+            fi
 
       - run: npm install
         working-directory: .
 
       - name: Write release notifications
         if: github.repository_owner == 'maplibre'
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.MAPLIBRE_NATIVE_PRIVATE_TOKEN }}
         run: node .github/scripts/notify-release-on-prs.ts --tag ${{ needs.android-create-release.outputs.version_tag }}
         working-directory: .