From d8270d741175c2ba717df9cb2b43b9c8e860c78b Mon Sep 17 00:00:00 2001
From: James Newman <james.newman@rokt.com>
Date: Thu, 30 Jul 2026 10:28:20 -0400
Subject: [PATCH 1/2] ci: build core SDK once and share Maven Local across kit
 matrix

All 22 build-kits matrix jobs ran ./gradlew
publishMavenPublicationToMavenLocal, rebuilding the same core SDK 22
times per run.

Add a single publish-core job that runs the publish once, archives
~/.m2/repository (1.2 MB), and uploads it as an artifact. The matrix
jobs now download and untar it into $HOME/.m2 instead of rebuilding.

The root publish emits exactly four coordinates - android-core,
android-kit-base, android-kit-plugin and android-plugin - plus their
maven-metadata-local.xml. Nothing else writes to ~/.m2/repository
(Gradle's dependency cache lives in ~/.gradle), so archiving the whole
repository dir cannot miss anything. KitPlugin restricts mavenLocal()
to includeGroup 'com.mparticle' and excludes that group from Maven
Central, so those four are precisely what the kit builds need.

Also quote $GITHUB_ENV to satisfy shellcheck SC2086, which the
pre-existing step tripped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build-kits.yml | 56 +++++++++++++++++++++++++++++---
 1 file changed, 51 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build-kits.yml b/.github/workflows/build-kits.yml
index 71ed080e7..1cebee425 100644
--- a/.github/workflows/build-kits.yml
+++ b/.github/workflows/build-kits.yml
@@ -21,9 +21,47 @@ jobs:
       - id: set
         run: echo "matrix=$(jq -c . kits/matrix.json)" >> "$GITHUB_OUTPUT"
 
+  # Builds the core SDK once and shares the resulting Maven Local repository with
+  # every build-kits matrix job, instead of each of them rebuilding it.
+  publish-core:
+    name: Publish core SDK to Maven Local
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set SDK version
+        run: |
+          echo "ORG_GRADLE_PROJECT_VERSION=$(head -n 1 VERSION)" >> "$GITHUB_ENV"
+          echo "ORG_GRADLE_PROJECT_version=$(head -n 1 VERSION)" >> "$GITHUB_ENV"
+
+      - name: Install JDK 17
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
+        with:
+          distribution: zulu
+          java-version: "17"
+
+      # Writable, unlike build-kits below: one job, so one cache entry per run.
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+
+      - name: Publish core SDK to Maven Local
+        run: ./gradlew publishMavenPublicationToMavenLocal
+
+      - name: Archive Maven Local repository
+        run: tar -czf maven-local.tar.gz -C "$HOME/.m2" repository
+
+      - name: Upload Maven Local repository
+        uses: actions/upload-artifact@v7
+        with:
+          name: maven-local-core
+          path: maven-local.tar.gz
+          retention-days: 1
+          compression-level: 0
+
   build-kits:
     name: Build ${{ matrix.kit.name }}
-    needs: load-matrix
+    needs: [load-matrix, publish-core]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -35,8 +73,8 @@ jobs:
 
       - name: Set SDK version
         run: |
-          echo "ORG_GRADLE_PROJECT_VERSION=$(head -n 1 VERSION)" >> $GITHUB_ENV
-          echo "ORG_GRADLE_PROJECT_version=$(head -n 1 VERSION)" >> $GITHUB_ENV
+          echo "ORG_GRADLE_PROJECT_VERSION=$(head -n 1 VERSION)" >> "$GITHUB_ENV"
+          echo "ORG_GRADLE_PROJECT_version=$(head -n 1 VERSION)" >> "$GITHUB_ENV"
 
       - name: Install JDK 17
         uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
@@ -49,8 +87,16 @@ jobs:
         with:
           cache-read-only: true
 
-      - name: Publish core SDK to Maven Local
-        run: ./gradlew publishMavenPublicationToMavenLocal
+      - name: Download Maven Local repository
+        uses: actions/download-artifact@v7
+        with:
+          name: maven-local-core
+
+      - name: Restore core SDK into Maven Local
+        run: |
+          mkdir -p "$HOME/.m2"
+          tar -xzf maven-local.tar.gz -C "$HOME/.m2"
+          rm maven-local.tar.gz
 
       - name: Run kit unit tests
         if: ${{ matrix.kit.skip_unit_tests != true }}

From db878f0508ee48706f48eec85920c039e035f0f6 Mon Sep 17 00:00:00 2001
From: James Newman <james.newman@rokt.com>
Date: Thu, 30 Jul 2026 11:38:55 -0400
Subject: [PATCH 2/2] ci: pin artifact actions to commit SHAs

The semgrep security check blocks unpinned action refs. Pin the two new
uses to commit SHAs:

  actions/upload-artifact   043fb46 (v7.0.1)
  actions/download-artifact 37930b1 (v7.0.0)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build-kits.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-kits.yml b/.github/workflows/build-kits.yml
index 1cebee425..23c2b26e2 100644
--- a/.github/workflows/build-kits.yml
+++ b/.github/workflows/build-kits.yml
@@ -52,7 +52,7 @@ jobs:
         run: tar -czf maven-local.tar.gz -C "$HOME/.m2" repository
 
       - name: Upload Maven Local repository
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: maven-local-core
           path: maven-local.tar.gz
@@ -88,7 +88,7 @@ jobs:
           cache-read-only: true
 
       - name: Download Maven Local repository
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: maven-local-core