build: migrate build infrastructure from Gradle to Maven (#1346)

* build: migrate build infrastructure from Gradle to Maven

Migrates the build system from Gradle to Maven, mirroring the v1 SDK
migration (microsoftgraph/msgraph-sdk-java#2613), and moves CI/CD away
from PAT-based Azure Artifacts auth to PAT-less MavenAuthenticate.

- Add pom.xml, Maven wrapper (mvnw/mvnw.cmd/.mvn)
- Replace gradle-build.yml with maven-build.yml; update codeql to mvnw
- Update ADO ci-build.yml and daily-ci-build.yml to Maven + MavenAuthenticate@0
- dependabot: root -> maven, /android kept as gradle
- release-please: xml xpath updater for pom.xml version
- android: inline dependencies; remove shared gradle/dependencies.gradle
- Remove all root Gradle files and the java-8 subproject

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: make mvnw executable and raise javadoc heap for large beta SDK

- Set the executable bit on mvnw so Linux CI (GitHub Actions) can run it
  (was failing with exit 126 / Permission denied)
- Increase maven-javadoc-plugin fork heap to -J-Xmx4g; the beta SDK has
  27,817 source files and OOMed javadoc at 2g (Please increase memory)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

.azure-pipelines/ci-build.yml

@@ -70,29 +70,72 @@ extends:
                   Copy-Item $(downloadLocalProperties.secureFilePath) local.properties -Verbose
                 displayName: Copy secring and 'local.properties'
 
-              - script: ./gradlew publishToMavenLocal -PmavenCentralPublishingEnabled=true -PmavenCentralSnapshotArtifactSuffix=""
+              - pwsh: |
+                  # maven-gpg-plugin signs via the local gpg keyring, so the key from
+                  # secring.gpg must be imported into gpg before signing can succeed.
+                  gpg --batch --import secring.gpg
+                displayName: Import GPG signing key
+
+              - pwsh: |
+$props = Get-Content local.properties -Raw
+$keyId = ($props | Select-String -Pattern 'signing\.keyId=([^\r\n]+)').Matches.Groups[1].Value.Trim()
+$keyPassword = ($props | Select-String -Pattern 'signing\.password=([^\r\n]+)').Matches.Groups[1].Value.Trim()
+                  $settingsXml = @"
+                  <settings>
+                    <mirrors>
+                      <mirror>
+                        <id>GraphDeveloperExperiences_Public</id>
+                        <mirrorOf>*</mirrorOf>
+                        <url>https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/maven/v1</url>
+                      </mirror>
+                    </mirrors>
+                    <profiles>
+                      <profile>
+                        <id>signing</id>
+                        <properties>
+                          <gpg.keyname>$keyId</gpg.keyname>
+                          <gpg.passphrase>$keyPassword</gpg.passphrase>
+                        </properties>
+                      </profile>
+                    </profiles>
+                  </settings>
+                  "@
+                  $settingsDir = Join-Path $HOME ".m2"
+                  New-Item -ItemType Directory -Path $settingsDir -Force | Out-Null
+                  $settingsXml | Set-Content (Join-Path $settingsDir "settings.xml") -Encoding UTF8
+                displayName: Configure Maven settings
+
+              - task: MavenAuthenticate@0
+                displayName: Authenticate to Azure Artifacts feed (PAT-less)
+                inputs:
+                  artifactsFeeds: 'GraphDeveloperExperiences_Public'
+
+              - script: ./mvnw install -Psigning --no-transfer-progress
                 displayName: Publish to local Maven for verification
                 condition: contains(variables['build.sourceBranch'], 'refs/tags/v')
 
-              - script: ./gradlew publishToMavenLocal -PmavenCentralPublishingEnabled=true
+              - script: ./mvnw install -Psigning --no-transfer-progress
                 displayName: Publish to local Maven for verification
                 condition: not(contains(variables['build.sourceBranch'], 'refs/tags/v'))
 
-              - script: ./gradlew publishMavenPublicationToADORepository -PmavenCentralPublishingEnabled=true -PmavenCentralSnapshotArtifactSuffix=""
-                displayName: Publish to local Maven ADO for ESRP
+              - script: ./mvnw deploy -Psigning --no-transfer-progress -DaltDeploymentRepository=ADO::default::file://$(Build.SourcesDirectory)/target/staging-deploy
+                displayName: Stage artifacts for ESRP
                 condition: contains(variables['build.sourceBranch'], 'refs/tags/v')
 
-              - script: ./gradlew publishMavenPublicationToADORepository -PmavenCentralPublishingEnabled=true
-                displayName: Publish to local Maven ADO for ESRP
+              - script: ./mvnw deploy -Psigning --no-transfer-progress -DaltDeploymentRepository=ADO::default::file://$(Build.SourcesDirectory)/target/staging-deploy
+                displayName: Stage artifacts for ESRP
                 condition: not(contains(variables['build.sourceBranch'], 'refs/tags/v'))
 
               - pwsh: |
-                  $contents = Get-Content gradle.properties -Raw
-                  $major = $contents | Select-String -Pattern 'mavenMajorVersion\s*=\s*([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
-                  $minor = $contents | Select-String -Pattern 'mavenMinorVersion\s*=\s*([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
-                  $patch = $contents | Select-String -Pattern 'mavenPatchVersion\s*=\s*([0-9]+)' | ForEach-Object { $_.Matches.Groups[1].Value }
+                  $pomXml = [xml](Get-Content pom.xml -Raw)
+                  $ns = New-Object System.Xml.XmlNamespaceManager($pomXml.NameTable)
+                  $ns.AddNamespace('m', $pomXml.DocumentElement.NamespaceURI)
+                  $version = $pomXml.SelectSingleNode('/m:project/m:version', $ns).InnerText
                   $snapshot_suffix = if ($Env:BRANCH_NAME.StartsWith('refs/tags/v')) { '' } else { '-SNAPSHOT' }
-                  $version = "$major.$minor.$patch$snapshot_suffix"
+                  # If version already contains -SNAPSHOT and we're on a tag, strip it
+                  if ($Env:BRANCH_NAME.StartsWith('refs/tags/v')) {
+                    $version = $version -replace '-SNAPSHOT$', ''
+                  }
                   echo "Current version is $version"
                   echo "##vso[task.setvariable variable=PACKAGE_VERSION;]$version"
                 displayName: Get current version
@@ -105,7 +148,7 @@ extends:
                 displayName: Inspect contents of local Maven cache
 
               - pwsh: |
-                  $packageFullPath = Join-Path -Path "./" -ChildPath "build/publishing-repository/com/microsoft/graph/microsoft-graph-beta" -AdditionalChildPath "$(PACKAGE_VERSION)"
+                  $packageFullPath = Join-Path -Path "./target/staging-deploy" -ChildPath "com/microsoft/graph/microsoft-graph-beta" -AdditionalChildPath "$(PACKAGE_VERSION)"
                   echo "Package full path: $packageFullPath"
                   echo "##vso[task.setvariable variable=PACKAGE_PATH;]$packageFullPath"
                 displayName: Get the package full path

.azure-pipelines/daily-ci-build.yml

@@ -43,21 +43,47 @@ extends:
               - checkout: self
                 submodules: recursive
 
-              - script: |
-                  sed -i "/mavenCentral()/d" build.gradle
-                  sed -i "/gradlePluginPortal()/d" settings.gradle
-                  sed -i "/mavenCentral()/d" settings.gradle
-                displayName: Strip plugins and public repos for network-isolated build
+              - task: JavaToolInstaller@1
+                inputs:
+                  versionSpec: '17'
+                  jdkArchitectureOption: 'x64'
+                  jdkSourceOption: 'PreInstalled'
+
+              - pwsh: |
+                  # Route all Maven resolution through the Azure Artifacts feed (Maven Central upstream)
+                  # so the network-isolated build never reaches the public internet. Credentials for the
+                  # mirror are injected PAT-less by the MavenAuthenticate task below; the mirror <id> must
+                  # match the <server> id it generates (the feed name).
+                  $settingsXml = @"
+                  <settings>
+                    <mirrors>
+                      <mirror>
+                        <id>GraphDeveloperExperiences_Public</id>
+                        <mirrorOf>*</mirrorOf>
+                        <url>https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/maven/v1</url>
+                      </mirror>
+                    </mirrors>
+                  </settings>
+                  "@
+                  $settingsDir = Join-Path $HOME ".m2"
+                  New-Item -ItemType Directory -Path $settingsDir -Force | Out-Null
+                  $settingsXml | Set-Content (Join-Path $settingsDir "settings.xml") -Encoding UTF8
+                displayName: Configure Maven mirror for network-isolated build
+
+              - task: MavenAuthenticate@0
+                displayName: Authenticate to Azure Artifacts feed (PAT-less)
+                inputs:
+                  artifactsFeeds: 'GraphDeveloperExperiences_Public'
 
-              - task: Gradle@4
+              - task: Maven@4
                 displayName: Build and Test SDK
                 inputs:
-                  gradleWrapperFile: 'gradlew'
-                  workingDirectory: '$(Build.SourcesDirectory)'
-                  tasks: 'assemble test'
-                  options: '--no-daemon -PGraphDeveloperExperiencesPublicPassword=$(ARTIFACTS_PAT)'
+                  mavenPomFile: 'pom.xml'
+                  goals: 'verify'
+                  options: '--no-transfer-progress'
                   publishJUnitResults: true
-                  testResultsFiles: '**/TEST-*.xml'
+                  testResultsFiles: '**/surefire-reports/TEST-*.xml'
                   javaHomeOption: 'JDKVersion'
                   jdkVersionOption: '1.17'
                   jdkArchitectureOption: 'x64'
+                  mavenOptions: '-Xmx3072m'

.github/dependabot.yml

@@ -1,10 +1,7 @@
 version: 2
 updates:
-- package-ecosystem: gradle
-  directories:
-  - "/"
-  - "/java-8"
-  - "/android"
+- package-ecosystem: maven
+  directory: "/"
   schedule:
     interval: weekly
     time: "09:00" # 9am UTC
@@ -22,6 +19,13 @@ updates:
     open-telemetry:
       patterns:
         - "*opentelemetry*"
+- package-ecosystem: gradle
+  directory: "/android"
+  schedule:
+    interval: weekly
+    time: "09:00" # 9am UTC
+  open-pull-requests-limit: 10
+  groups:
     android-build-tools:
       patterns:
         - "*android*"

.github/workflows/codeql-analysis.yml

@@ -49,7 +49,7 @@ jobs:
         with:
           java-version: 21
           distribution: 'temurin'
-          cache: gradle
+          cache: maven
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
@@ -76,10 +76,8 @@ jobs:
       #   If the Autobuild fails above, remove it and uncomment the following three lines.
       #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
 
-      - name: Grant execute permission for gradlew
-        run: chmod +x gradlew
-      - name: Build with Gradle
-        run: ./gradlew --no-build-cache build
+      - name: Build with Maven
+        run: ./mvnw compile --no-transfer-progress -DskipTests
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4

.github/workflows/gradle-build.yml .github/workflows/maven-build.yml.github/workflows/gradle-build.yml renamed to .github/workflows/maven-build.yml

@@ -1,4 +1,4 @@
-name: Gradle Build and Compare Package
+name: Maven Build
 
 on:
   push:
@@ -20,36 +20,29 @@ jobs:
         with:
           java-version: 21
           distribution: 'temurin'
-          cache: gradle
+          cache: maven
       - name: Move generated sources to correct package
         run: .\scripts\copyFilesOnBuild.ps1 -inputPath '.\src\main\java\com\microsoft\graph\beta\generated'
         shell: pwsh
-      - name: Grant Execute permission for gradlew
-        run: chmod +x gradlew
-      - name: Build with Gradle
-        run: ./gradlew build
+      - name: Build with Maven
+        run: ./mvnw verify --no-transfer-progress
       - name: Upload Unit Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v7
         with:
           name: UnitTests
           path: |
-            build/reports/tests/test/**
-            build/test-results/**
+            target/surefire-reports/**
       - name: Upload a Build Artifact
         uses: actions/upload-artifact@v7
         with:
           name: drop
           path: |
-            **/libs/*
-            build/generated-pom.xml
-            build/generated-pom.xml.asc
-            build.gradle
-            gradlew
-            gradlew.bat
-            settings.gradle
-            gradle.properties
-            **/gradle/**
+            target/*.jar
+            pom.xml
+            mvnw
+            mvnw.cmd
+            .mvn/**
             scripts/**
 
   build-java-8:
@@ -61,15 +54,12 @@ jobs:
         with:
           java-version: 8
           distribution: 'temurin'
-          cache: gradle
-      - name: Grant Execute permission for gradlew
-        run: chmod +x gradlew
+          cache: maven
       - name: Move generated sources to correct package
         run: .\scripts\copyFilesOnBuild.ps1 -inputPath '.\src\main\java\com\microsoft\graph\beta\generated'
         shell: pwsh
       - name: Build with Java 8
-        working-directory: ./java-8
-        run: .././gradlew -Dorg.gradle.jvmargs=-Xmx4g build
+        run: ./mvnw compile --no-transfer-progress
 
   build:
     needs: [build-latest-java, build-java-8]
@@ -83,19 +73,3 @@ jobs:
           else
             exit 1
           fi
-
-  dependency-submission:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push'
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v6
-      - name: Set up JDK
-        uses: actions/setup-java@v5
-        with:
-          java-version: 21
-          distribution: 'temurin'
-          cache: gradle
-      - name: Generate and submit dependency graph
-        uses: gradle/actions/dependency-submission@v4

.gitignore

@@ -20,17 +20,18 @@
 
 # virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
 hs_err_pid*
-/.gradle/
-/build/
-/bin/
+
+# Maven
+/target/
+
+# Maven wrapper
+!.mvn/wrapper/maven-wrapper.jar
 
 #Eclipse
 .project
 .classpath
 .settings
 
-# Maven
-/target/
 local.properties
 .idea
 *.gpg

.mvn/wrapper/maven-wrapper.jar

@@ -0,0 +1,4 @@
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
+distributionSha256Sum=4ec3f26fb1a692473aea0235c300bd20f0f9fe741947c82c1234cefd76ac3a3c
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
+wrapperSha256Sum=3d8f20ce6103913be8b52aef6d994e0c54705fb527324ceb9b835b338739c7a8

.mvn/wrapper/maven-wrapper.properties

@@ -71,4 +71,16 @@ android {
 	}
 }
 
-apply from: "../gradle/dependencies.gradle"
+dependencies {
+    implementation 'com.squareup.okhttp3:okhttp:4.12.0'
+    implementation 'jakarta.annotation:jakarta.annotation-api:2.1.1'
+
+    api 'com.microsoft.graph:microsoft-graph-core:3.6.6'
+
+    implementation 'com.microsoft.kiota:microsoft-kiota-authentication-azure:1.9.2'
+    implementation 'com.microsoft.kiota:microsoft-kiota-http-okHttp:1.9.2'
+    implementation 'com.microsoft.kiota:microsoft-kiota-serialization-json:1.9.2'
+    implementation 'com.microsoft.kiota:microsoft-kiota-serialization-text:1.9.2'
+    implementation 'com.microsoft.kiota:microsoft-kiota-serialization-form:1.9.2'
+    implementation 'com.microsoft.kiota:microsoft-kiota-serialization-multipart:1.9.2'
+}