Always publish releases when deploying new versions to Maven

[ptornhult]

I'm noticing that there are 2 new version of the library on Maven: https://mvnrepository.com/artifact/com.microsoft.identity.client/msal
7.0.2 and 7.0.3

But the latest release in Github: https://github.com/AzureAD/microsoft-authentication-library-for-android/releases
is only 7.0.1

Since this library is one of the most important libraries we use to sign in and authenticate our app users we need to have a very high confidence in this project. Since I can't see what has been released (no release notes yet of the latest versions) I'm afraid to update and I'm even wondering if the releases are yours of if these new version are even yours?

I don't know what your release process is, but for all our sakes it would be best if you changed the process to only build and publish new artifacts to Maven when a new release is created in github so there are no more manual mistakes (if that is what is happening rn.?)

[ptornhult]

We are using Renovate bot (smilar to Dependabot) to search for and update our dependencies automatically. We are only using the repositories:

        mavenCentral()
        google()
        gradlePluginPortal()

And right now we're seeing that there is a 7.1.0 version available (reported by the automated process of Renovate + Gradle) but 7.1.0 is neither in the releases here nor can I see it in MVN search online (though that can be a sync issue). It leads me to believe that there is another source code project that updates the binaries and we should we not trust this Git project OR that the 7.1.0 binaries are published by an another untrusted source and we shouldn't trust the releases at all anymore?

Can you please clarify what's going on / provide a little more transparency on this subject?

If this is truly an open source project hosted on github, I would want the binaries to be created from the published source code here. If you have a private repo that you are building the releases from and then later syncing here. How can we be sure that the binary releases are actually the same code as you publish here?

[fadidurah]

Seems we ran into AI Model throttling issue, reran triage for this issue

[github-actions]

Thank you for opening this issue!

Labels Applied:
Feature-Request: The user is requesting a change or enhancement in the library's release process to ensure consistency between Maven published versions and GitHub releases so that users can have confidence and visibility into updates..

🤖 AI Analysis

To address the inconsistency between the versions on Maven and GitHub and ensure a reliable and transparent release process, here are the recommendations:

1. Align GitHub Releases with Maven Releases:

   • Ensure that every version released to Maven is also tagged and documented as a GitHub release, including release notes for users.
   • Automate the release process to avoid discrepancies between Maven and GitHub.

2. Add Release Notes to GitHub for Missing Versions:

   • For the specific issue of 7.0.2 and 7.0.3 being on Maven but not appearing in GitHub releases, publish release notes and tags for these versions retroactively on GitHub for consistency.

3. Improve Communication with Users:

   • Clearly document the release process in the project’s README or CONTRIBUTING file, specifying how and when users can expect new versions announced on GitHub compared to Maven.
   • Mention in release notes if any changes were made between patch versions to address user concerns.

4. Automate Validation of Version Synchronization:

   • Implement CI checks to validate that any release build pushed to Maven Registry also triggers a release on GitHub.
   • Use GitHub Actions or similar tools for end-to-end release management.

5. Provide Confirmation for Artifact Authenticity:

   • Assure users that all artifacts published on Maven are signed and verified. For further transparency, consider adding a signing key fingerprint or checksum details for each release in GitHub.

NOTE: The MSAL library team should prioritize aligning this process to maintain trust and integrity, as users rely on these libraries for critical authentication processes. For now, the user can proceed carefully by staying on 7.0.1 if higher confidence is required or testing 7.0.3 after validation.

See also: #1695, #1540 for related automation and version management discussions.

Related Issues: #1695, #1540

---

📦 MSAL Version Update Available

You are using MSAL version 7.0.3. The latest version is 8.2.1.

We recommend updating to the latest version to benefit from bug fixes, security improvements, and new features.

implementation "com.microsoft.identity.client:msal:8.+"

Using 8.+ automatically gets patch updates within the 8.x series.

---

---

Need help? Comment with:

PING-COPILOT: <your question>

Privacy: Do not include credentials, tokens, or PII in PING-COPILOT requests.