Fix Android Maven Central publishing (#23190)

The Android release workflow has continued publishing AARs to S3, but
releases after 1.4.0 have not created deployments in Maven Central. The
release jobs reported success, so this failed silently.

The Maven plugin was still pinned to 0.31.0. Version 0.33 changed
parameterless `publishToMavenCentral()` to use the Central Portal
instead of the retired legacy OSSRH service, and 0.34 updates to the
current Portal APIs. This PR upgrades to 0.34.0 while deliberately
retaining the upload-only task: it creates a deployment for release
owners to review and publish manually in the Central Portal.

A manual Maven retry exposed a separate problem. Its container
initialized successfully, but the workflow reran generic Linux setup and
failed because the old `torchao==0.18.0.dev20260729` wheel is
unavailable. The final `Executing the custom container implementation
failed` line was the job wrapper reporting that script failure, not the
root cause.

This change:

- routes uploads to the Central Portal with the updated plugin;
- keeps publication manual by using `publishToMavenCentral`;
- adds the Central Portal review link to the job summary;
- separates the S3 existence check from Maven retry handling, so an
existing S3 AAR does not suppress a Maven retry;
- preserves existing S3 artifacts during Maven-only retries;
- removes the redundant failing Linux setup; and
- adds an optional source ref so a released tag can be rebuilt exactly.

Validation: Ruby YAML parsing and `git diff --check`.

This PR was authored with Claude.

Author: JacobSzwejbka

.github/workflows/android-release-artifacts.yml

@@ -9,10 +9,15 @@ on:
         type: string
         default: ''
       upload_to_maven:
-        description: Upload the AAR to maven staging repository
+        description: Upload the AAR to Maven Central for manual review
         required: false
         type: boolean
         default: false
+      source_ref:
+        description: Git ref or SHA to build; defaults to the workflow commit
+        required: false
+        type: string
+        default: ''
       flavor:
         description: Build flavor
         required: false
@@ -25,9 +30,13 @@ on:
         required: false
         type: string
       upload_to_maven:
-        description: Upload the AAR to maven staging repository
+        description: Upload the AAR to Maven Central for manual review
         required: false
         type: boolean
+      source_ref:
+        description: Git ref or SHA to build; defaults to the workflow commit
+        required: false
+        type: string
       flavor:
         type: choice
         options:
@@ -49,6 +58,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     outputs:
+      aar-exists: ${{ steps.check.outputs.aar-exists }}
       should-skip: ${{ steps.check.outputs.should-skip }}
     steps:
       - name: Check if this RC version is already in S3
@@ -57,19 +67,32 @@ jobs:
         run: |
           VERSION="${{ inputs.version }}"
           FLAVOR="${{ inputs.flavor }}"
+          UPLOAD_TO_MAVEN="${{ inputs.upload_to_maven }}"
           if [ -z "$FLAVOR" ]; then
             FLAVOR="xnnpack"
           fi
+          if [[ "$UPLOAD_TO_MAVEN" == "true" && -z "$VERSION" ]]; then
+            echo "A version is required when publishing to Maven Central"
+            exit 1
+          fi
           if [ -z "$VERSION" ]; then
             echo "No version name specified. Will create a snapshot AAR"
+            echo "aar-exists=false" >> $GITHUB_OUTPUT
             echo "should-skip=false" >> $GITHUB_OUTPUT
             exit 0
           fi
           if curl -I "https://ossci-android.s3.amazonaws.com/executorch/release/${VERSION}-${FLAVOR}/executorch.aar" | grep "200 OK"; then
             echo "AAR already exists at https://ossci-android.s3.amazonaws.com/executorch/release/${VERSION}-${FLAVOR}/executorch.aar"
-            echo "Will skip build/upload"
-            echo "should-skip=true" >> $GITHUB_OUTPUT
+            echo "aar-exists=true" >> $GITHUB_OUTPUT
+            if [[ "$UPLOAD_TO_MAVEN" == "true" ]]; then
+              echo "Maven publishing requested. Will rebuild without replacing the S3 artifact"
+              echo "should-skip=false" >> $GITHUB_OUTPUT
+            else
+              echo "Will skip build/upload"
+              echo "should-skip=true" >> $GITHUB_OUTPUT
+            fi
           else
+            echo "aar-exists=false" >> $GITHUB_OUTPUT
             echo "should-skip=false" >> $GITHUB_OUTPUT
           fi
 
@@ -86,7 +109,7 @@ jobs:
       secrets-env: EXECUTORCH_MAVEN_SIGNING_KEYID EXECUTORCH_MAVEN_SIGNING_PASSWORD EXECUTORCH_MAVEN_CENTRAL_PASSWORD EXECUTORCH_MAVEN_CENTRAL_USERNAME EXECUTORCH_MAVEN_SIGNING_GPG_KEY_CONTENTS
       docker-image: ${{ needs.docker-image.outputs.docker-registry }}/ci-image:executorch-ubuntu-22.04-clang12-android-${{ needs.docker-image.outputs.ci-docker-hash }}
       submodules: 'recursive'
-      ref: ${{ github.sha }}
+      ref: ${{ inputs.source_ref || github.sha }}
       timeout: 90
       upload-artifact: android-apps
       upload-artifact-to-s3: true
@@ -97,10 +120,9 @@ jobs:
         export CMAKE_CXX_COMPILER_LAUNCHER=sccache
         export CMAKE_C_COMPILER_LAUNCHER=sccache
 
-        # The generic Linux job chooses to use base env, not the one setup by the image
+        # The Android image already contains the build dependencies and pinned PyTorch.
         CONDA_ENV=$(conda env list --json | jq -r ".envs | .[-1]")
         conda activate "${CONDA_ENV}"
-        PYTHON_EXECUTABLE=python bash .ci/scripts/setup-linux.sh --build-tool buck2
         export ARTIFACTS_DIR_NAME=artifacts-to-be-uploaded
 
         mkdir -p ~/.gradle
@@ -157,15 +179,22 @@ jobs:
 
         shasum -a 256 "${ARTIFACTS_DIR_NAME}/executorch-${FLAVOR}.aar"
 
-        # Publish to maven staging
+        # Upload a deployment to Maven Central. A release owner reviews and
+        # publishes it manually in the Central Portal.
         UPLOAD_TO_MAVEN="${{ inputs.upload_to_maven }}"
         if [[ "$UPLOAD_TO_MAVEN" == "true" ]]; then
-          (cd extension/android; ANDROID_HOME="${ANDROID_SDK:-/opt/android/sdk}" ./gradlew  ${GRADLE_ARGS} :executorch_android:publishToMavenCentral)
+          (cd extension/android; ANDROID_HOME="${ANDROID_SDK:-/opt/android/sdk}" ./gradlew --no-daemon --console=plain ${GRADLE_ARGS} :executorch_android:publishToMavenCentral)
+          {
+            echo "### Maven Central deployment uploaded"
+            echo
+            echo "Review and publish the deployment in the [Central Portal](https://central.sonatype.com/publishing/deployments)."
+          } >> "$GITHUB_STEP_SUMMARY"
         fi
 
   upload-release-aar:
     name: upload-release-aar
-    needs: build-aar
+    needs: [check-if-aar-exists, build-aar]
+    if: ${{ needs.check-if-aar-exists.outputs.aar-exists != 'true' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     permissions:

extension/android/executorch_android/build.gradle

@@ -9,7 +9,9 @@
 
 plugins {
     id "com.android.library" version "8.9.0"
-    id "com.vanniktech.maven.publish" version "0.31.0"
+    // 0.33+ routes publishToMavenCentral() through the Central Portal instead
+    // of the retired legacy OSSRH service.
+    id "com.vanniktech.maven.publish" version "0.34.0"
     id 'com.diffplug.spotless' version '8.0.0'
     alias(libs.plugins.jetbrains.kotlin.android)
 }