KMP upgrade

.gitattributes

@@ -0,0 +1,23 @@
+# Normalize line endings: store text files as LF in the repository,
+# regardless of the contributor's OS. Working-tree checkout stays native.
+* text=auto eol=lf
+
+# Windows scripts stay CRLF byte-for-byte (Gradle ships gradlew.bat as CRLF);
+# -text means git never converts them, so they are not normalized to LF.
+*.bat -text
+*.cmd -text
+*.ps1 -text
+
+# Binary artifacts — never touch their bytes.
+*.png  binary
+*.webp binary
+*.jpg  binary
+*.jpeg binary
+*.ico  binary
+*.so   binary
+*.dylib binary
+*.dll  binary
+*.a    binary
+*.jar  binary
+*.keystore binary
+*.xcuserstate binary

.github/actions/cache-gradle-wrapper/action.yml

@@ -0,0 +1,10 @@
+name: Cache Gradle wrapper
+description: Cache Gradle wrapper distributions
+runs:
+  using: composite
+  steps:
+    - name: Cache Gradle wrapper
+      uses: actions/cache@v4
+      with:
+        path: ~/.gradle/wrapper/dists
+        key: ${{ runner.os }}-gradle-wrapper-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}

.github/actions/cache-konan/action.yml

@@ -0,0 +1,17 @@
+name: Cache Kotlin/Native (konan)
+description: >-
+  Cache the ~/.konan toolchain (Kotlin/Native compiler, LLVM, platform sysroots) so native jobs do
+  not re-download it from scratch on every run.
+runs:
+  using: composite
+  steps:
+    - name: Cache konan
+      uses: actions/cache@v4
+      with:
+        path: ~/.konan
+        # The konan toolchain version tracks the Kotlin version, which lives in libs.versions.toml.
+        key: konan-${{ runner.os }}-${{ hashFiles('gradle/libs.versions.toml') }}
+        # On a miss (e.g. Kotlin bumped) restore the previous konan and let it download only the
+        # delta, instead of pulling the whole toolchain again.
+        restore-keys: |
+          konan-${{ runner.os }}-

.github/actions/check-publish-secrets/action.yml

@@ -0,0 +1,41 @@
+name: Check publish secrets
+description: Fail fast when Maven Central or GPG secrets are missing
+inputs:
+  maven_username:
+    description: Maven Central username
+    required: true
+  maven_password:
+    description: Maven Central password
+    required: true
+  gpg_private_key:
+    description: GPG private key
+    required: true
+  gpg_passphrase:
+    description: GPG passphrase
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Verify publish secrets
+      shell: bash
+      run: |
+        missing=0
+        if [ -z "${{ inputs.maven_username }}" ]; then
+          echo "Missing secret: MAVEN_CENTRAL_USERNAME"
+          missing=1
+        fi
+        if [ -z "${{ inputs.maven_password }}" ]; then
+          echo "Missing secret: MAVEN_CENTRAL_PASSWORD"
+          missing=1
+        fi
+        if [ -z "${{ inputs.gpg_private_key }}" ]; then
+          echo "Missing secret: GPG_PRIVATE_KEY"
+          missing=1
+        fi
+        if [ -z "${{ inputs.gpg_passphrase }}" ]; then
+          echo "Missing secret: GPG_PASSPHRASE"
+          missing=1
+        fi
+        if [ "$missing" -ne 0 ]; then
+          exit 1
+        fi

.github/actions/setup-android-tools/action.yml

@@ -0,0 +1,42 @@
+name: Setup Android SDK/NDK/CMake
+description: Install Android SDK, required NDK, and CMake for native builds.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Configure Android SDK environment
+      shell: bash
+      run: |
+        set -euo pipefail
+        case "${RUNNER_OS}" in
+          Linux) SDK_ROOT="$HOME/android-sdk" ;;
+          macOS) SDK_ROOT="$HOME/Library/Android/sdk" ;;
+          *) echo "Unsupported OS: ${RUNNER_OS}" >&2; exit 1 ;;
+        esac
+        echo "ANDROID_SDK_ROOT=${SDK_ROOT}" >> "${GITHUB_ENV}"
+        echo "ANDROID_HOME=${SDK_ROOT}" >> "${GITHUB_ENV}"
+        echo "${SDK_ROOT}/cmdline-tools/latest/bin" >> "${GITHUB_PATH}"
+        echo "${SDK_ROOT}/platform-tools" >> "${GITHUB_PATH}"
+
+    - name: Cache Android SDK
+      uses: actions/cache@v4
+      env:
+        ANDROID_SDK_CACHE_KEY: >-
+          android-sdk-${{ runner.os }}-${{ hashFiles(
+            '.github/actions/setup-android-tools/action.yml',
+            '.github/actions/setup-android-tools/install_cmdline_tools.sh',
+            '.github/actions/setup-android-tools/install_sdk_packages.sh'
+          ) }}
+      with:
+        path: ${{ env.ANDROID_SDK_ROOT }}
+        key: ${{ env.ANDROID_SDK_CACHE_KEY }}
+        restore-keys: |
+          android-sdk-${{ runner.os }}-
+
+    - name: Install Android commandline tools
+      shell: bash
+      run: bash ./.github/actions/setup-android-tools/install_cmdline_tools.sh
+
+    - name: Install Android SDK packages
+      shell: bash
+      run: bash ./.github/actions/setup-android-tools/install_sdk_packages.sh

.github/actions/setup-android-tools/install_cmdline_tools.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if command -v sdkmanager >/dev/null 2>&1; then
+  exit 0
+fi
+
+mkdir -p "${ANDROID_SDK_ROOT}/cmdline-tools"
+case "${RUNNER_OS}" in
+  Linux) TOOLS_ZIP="commandlinetools-linux-14742923_latest.zip" ;;
+  macOS) TOOLS_ZIP="commandlinetools-mac-14742923_latest.zip" ;;
+  *) echo "Unsupported OS: ${RUNNER_OS}" >&2; exit 1 ;;
+esac
+export TOOLS_ZIP
+
+curl -fsSL "https://dl.google.com/android/repository/${TOOLS_ZIP}" -o "${RUNNER_TEMP}/${TOOLS_ZIP}"
+if command -v unzip >/dev/null 2>&1; then
+  unzip -q "${RUNNER_TEMP}/${TOOLS_ZIP}" -d "${ANDROID_SDK_ROOT}/cmdline-tools"
+else
+  python3 -c 'import os, zipfile; sdk_root=os.environ["ANDROID_SDK_ROOT"]; zip_path=os.path.join(os.environ["RUNNER_TEMP"], os.environ["TOOLS_ZIP"]); dest_dir=os.path.join(sdk_root, "cmdline-tools"); zipfile.ZipFile(zip_path, "r").extractall(dest_dir)'
+fi
+mv "${ANDROID_SDK_ROOT}/cmdline-tools/cmdline-tools" "${ANDROID_SDK_ROOT}/cmdline-tools/latest"

.github/actions/setup-android-tools/install_sdk_packages.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+yes | sdkmanager --sdk_root="${ANDROID_SDK_ROOT}" --licenses >/dev/null || true
+# API 37 is published only as the versioned package platforms;android-37.0 — there is no bare
+# platforms;android-37 in the SDK repo (see actions/runner-images#13859).
+sdkmanager --sdk_root="${ANDROID_SDK_ROOT}" "platform-tools" "platforms;android-37.0" "ndk;29.0.14206865" "cmake;4.1.2"
+# AGP resolves compileSdk 37 to the target hash "android-37", but the platform installs into
+# platforms/android-37.0. Alias it so Gradle can find the platform. -sfn keeps it idempotent across
+# cache-restored runs (overwrites a stale link instead of nesting one inside the target dir).
+ln -sfn android-37.0 "${ANDROID_SDK_ROOT}/platforms/android-37"

.github/codeql/codeql-config.yml

@@ -0,0 +1,16 @@
+name: LevelDB Multiplatform CodeQL Config
+
+paths-ignore:
+  - "**/.gradle/**"
+  - "**/build/**"
+  - "**/out/**"
+  - "**/bin/**"
+  - "**/.idea/**"
+  - "**/.kotlin/**"
+  - "**/node_modules/**"
+  - "android-example/**"
+  - "ios-example/**"
+  - "native/leveldb/**"
+  - "native/.dockcross*/**"
+  - "native/prebuilt/**"
+  - "third_party/**"

.github/workflows/ci.yml

@@ -0,0 +1,74 @@
+name: PR Check
+permissions:
+  contents: read
+  pull-requests: write
+on:
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Tests (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-22.04
+            gradle_args: ":leveldb:check :leveldb:koverXmlReport"
+          - os: macos-latest
+            gradle_args: ":leveldb:check"
+          - os: windows-latest
+            gradle_args: ":leveldb:mingwX64Test"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: true
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: "temurin"
+          java-version: "17"
+
+      - name: Set up Android tools
+        if: runner.os == 'Linux'
+        uses: ./.github/actions/setup-android-tools
+
+      - name: Cache Gradle wrapper
+        uses: ./.github/actions/cache-gradle-wrapper
+
+      - name: Gradle cache
+        uses: gradle/actions/setup-gradle@v4
+
+      - name: Cache konan
+        uses: ./.github/actions/cache-konan
+
+      - name: Run tests
+        env:
+          JAVA_TOOL_OPTIONS: "-XX:+CreateCoredumpOnCrash -XX:ErrorFile=leveldb/hs_err_pid%p.log"
+        run: ./gradlew ${{ matrix.gradle_args }}
+
+      - name: Post coverage to PR
+        if: matrix.os == 'ubuntu-22.04'
+        uses: mi-kas/kover-report@v1
+        with:
+          path: leveldb/build/reports/kover/report.xml
+          token: ${{ secrets.GITHUB_TOKEN }}
+          title: Code coverage
+          update-comment: true
+
+      - name: Upload JVM crash logs
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: jvm-crash-${{ matrix.os }}
+          path: |
+            leveldb/hs_err_pid*.log
+            leveldb/core*

.github/workflows/codeql.yml

@@ -0,0 +1,63 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches: [ master ]
+
+jobs:
+  analyze:
+    name: CodeQL (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: c-cpp
+            build-mode: manual
+          #            kotlin 2.3 is not supported by CodeQL yet
+          #          - language: java-kotlin
+          #            build-mode: manual
+          - language: actions
+            build-mode: none
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: true
+
+      - name: Setup Java
+        if: matrix.language == 'java-kotlin'
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Build native C/C++ (for CodeQL)
+        if: matrix.language == 'c-cpp'
+        working-directory: native
+        run: |
+          cmake --preset linux-x86_64-debug
+          cmake --build --preset linux-x86_64-debug
+
+      - name: Build Java/Kotlin
+        if: matrix.language == 'java-kotlin'
+        run: |
+          ./gradlew :leveldb:check --no-daemon
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v3