Build modernization: Gradle 9.5, AGP 9.2, Kotlin 2.3, and tooling updates

[solcott]

Overview

This PR modernizes the build infrastructure across the board — toolchain upgrades,
configuration cache adoption, CI improvements, and migration to current plugin APIs.

Changes

Gradle & Toolchain

• Gradle 8.6 → 9.5.1
• Added gradle/gradle-daemon-jvm.properties pinning the daemon to Azul JDK 17
• Enabled Gradle configuration cache (org.gradle.configuration-cache=true)
• Disabled configureondemand (incompatible with configuration cache)
• Added updateDaemonJvm task configured for JDK 17 / Azul

Dependency & Plugin Updates

• AGP 8.0 → 9.2.1 (migrates to com.android.kotlin.multiplatform.library plugin)
• Kotlin 2.0.20 → 2.3.21
• kotlinx.coroutines 1.8.1 → 1.11.0
• kotlinx.serialization 1.6.3 → 1.11.0
• atomicfu 0.24.0 → 0.33.0
• Dokka 1.9.20 → 2.2.0 (new DokkaExtension API)
• KMMBridge 0.3.2 → 1.2.1 (migrates to co.touchlab.kmmbridge.github plugin)
• ktlint Gradle plugin 12.1 → 14.2, ktlint 0.39 → 1.8
• Kover 0.9.0-RC → 0.9.8
• Binary compatibility validator 0.15.0-Beta.2 → 0.18.1
• vanniktech maven publish 0.34 → 0.36
• Removed unused dependencies: molecule, androidx-paging, jacoco

Build Script Modernization

• Removed buildscript {} block — all plugins now declared via alias(libs.plugins.*) in the root build.gradle.kts
• All plugin versions centralized in libs.versions.toml
• Added VersionCatalogExt.kt with typed accessors for version catalog values (JVM toolchain, compat version, SDK levels, store version), replacing the hardcoded Versions object
• JVM target/toolchain versions now driven from the version catalog (jvmToolchain = 17, jvmCompat = 11)
• configureAndroid() updated for the new multiplatform Android library plugin API (namespace, withHostTest/withDeviceTest, compiler options)
• Removed per-module android { namespace = ... } and AndroidManifest.xml from cache, core, and multicast — namespace now set centrally in the convention plugin
• Migrated sourceSets { val x by getting { } } to sourceSets { x { } } idiom across submodules

CI / GitHub Actions

• actions/checkout v4 → v6
• actions/setup-java v4 → v5
• gradle/gradle-build-action → gradle/actions/setup-gradle@v6
• codecov/codecov-action v4 → v6
• Added explicit permissions block to CI job (least-privilege: contents: read, checks: write, pull-requests: write)
• Added --continue flag to build step so all module failures are reported in one run
• Added JUnit test report publishing via mikepenz/action-junit-report@v5 (runs on failure too)
• Codecov upload now guarded by github.repository == 'MobileNativeFoundation/Store' to avoid failures on forks
• Overhauled create_swift_package.yml / KMMBridge workflows based on current KMMBridgeSPMQuickStart template; added separate KMMBridge-Debug.yml and KMMBridge-Release.yml dispatch workflows

Lint / Style

• Added .editorconfig disabling ktlint_standard_import-ordering for Kotlin files
• Expanded ktlint additionalEditorconfig rules to suppress several noisy checks project-wide

Other

• rx2: migrated deprecated TestCoroutineScope → TestScope
• cache API: relaxed getAllPresent() from abstract to default interface method
• gradle.properties: removed deprecated kotlin.js.compiler=ir
• VERSION_NAME set to 5.1.0-SNAPSHOT for development

[solcott]

Looks like the following github actions are not on your orgs allow list:

softprops/action-gh-release@v2 — used in create_swift_package.yml. Used for KMMBridge publishing.
touchlab/ga-update-release-tag@v1 — used in create_swift_package.yml. Used for KMMBridge publishing.

It looks like the Create Swift Package action has never been run. If you don't think it will be run in the future I can remove the KMMBridge support as well as create_swift_package.yml where these actions are used.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.17%. Comparing base (213e574) to head (0ce44bb).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #736   +/-   ##
=======================================
  Coverage   80.17%   80.17%           
=======================================
  Files          42       42           
  Lines         928      928           
  Branches      177      177           
=======================================
  Hits          744      744           
  Misses        110      110           
  Partials       74       74           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[solcott]

Hi @matt-ramotar, friendly nudge on this one. I know it landed out of the blue as one big PR, and a 30-file toolchain/CI/publishing change is a lot to take on in one review, so I'm happy to make it easier to digest.

I rebased onto current main today. It's mergeable and CI is running clean, so there's nothing broken or behind to untangle here, it just needs a look.

If the size is the sticking point, I can split it into small, independently-reviewable PRs, each green on its own, in a low-risk-first order:

1. Gradle wrapper bump (+ foojay-resolver)
2. CI actions refresh (checkout/setup-java/setup-gradle/codecov, least-privilege permissions block)
3. Dependency bumps (Kotlin 2.3, coroutines, serialization, atomicfu; drop unused molecule/paging/jacoco)
4. Lint/style (.editorconfig + ktlint rules)
5. Build-script modernization (remove buildscript {}, move plugins to version catalog, VersionCatalogExt)
6. AGP 9.2 / Android KMP library plugin migration
7. KMMBridge / Swift Package publishing overhaul — fully optional; I can drop this entirely if you don't publish SPM artifacts

Would that split be easier to review, or would you rather take it as one PR? Just tell me the format you prefer and I'll deliver it that way. (Also still flagging the two Actions not on the org allow-list — softprops/action-gh-release@v2 and touchlab/ga-update-release-tag@v1 — both only used by the KMMBridge workflow in #7, so they go away if you skip that piece.)