Add Java and Kotlin protobuf bindings

.gitattributes

@@ -2,4 +2,6 @@ bindings/typescript/scip_pb.ts linguist-generated=true
 bindings/go/scip/scip.pb.go linguist-generated=true
 bindings/rust/src/generated/scip.rs linguist-generated=true
 bindings/haskell/src/Proto/**.hs linguist-generated=true
+bindings/java/src/main/java/org/scip_code/scip/**.java linguist-generated=true
+bindings/kotlin/src/main/kotlin/org/scip_code/scip/**.kt linguist-generated=true
 docs/scip.md linguist-generated=true

.github/workflows/jvm-bindings.yaml

@@ -0,0 +1,53 @@
+name: JVM bindings
+
+# The Java and Kotlin bindings are built with Maven directly rather than Nix
+# because scip-kotlin-bindings depends on scip-java-bindings as a Maven
+# artifact, which nixpkgs' offline `maven.buildMavenPackage` sandbox cannot
+# resolve from the sibling derivation.
+
+on:
+  pull_request:
+    paths:
+      - bindings/java/**
+      - bindings/kotlin/**
+      - cmd/scip/version.txt
+      - scip.proto
+      - .github/workflows/jvm-bindings.yaml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: jvm-bindings-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 11
+          cache: maven
+
+      - name: Validate pom.xml versions match cmd/scip/version.txt
+        run: |
+          set -euo pipefail
+          expected=$(cat cmd/scip/version.txt)
+          xpath='/*[local-name()="project"]/*[local-name()="version"]/text()'
+          for pom in bindings/java/pom.xml bindings/kotlin/pom.xml; do
+            actual=$(xmllint --xpath "$xpath" "$pom")
+            if [ "$actual" != "$expected" ]; then
+              echo "::error file=$pom::version is '$actual', expected '$expected'"
+              exit 1
+            fi
+          done
+
+      - name: Build scip-java-bindings and install to local Maven repo
+        run: mvn -B -ntp -Prelease -Dgpg.skip=true -f bindings/java/pom.xml install
+
+      - name: Build scip-kotlin-bindings (resolves scip-java-bindings from local repo)
+        run: mvn -B -ntp -Prelease -Dgpg.skip=true -f bindings/kotlin/pom.xml verify

.github/workflows/release.yaml

@@ -91,6 +91,46 @@ jobs:
           fi
         working-directory: bindings/rust
 
+  publish-jvm-bindings:
+    needs: publish
+    runs-on: ubuntu-latest
+    # Maven Central publication with waitUntil=published can block for
+    # 10-30 min per module while Sonatype mirrors propagate. Two
+    # sequential deploys (Java then Kotlin, which resolves Java from
+    # Central) means worst-case ~60 min.
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: v${{ inputs.version }}
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 11
+          cache: maven
+          server-id: central
+          server-username: MAVEN_USERNAME
+          server-password: MAVEN_PASSWORD
+          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+
+      # scip-kotlin-bindings depends on scip-java-bindings at the same
+      # version and resolves it from Central, not from this runner. The
+      # release profile sets waitUntil=published, so the Java step
+      # blocks until the artifact is live on repo1.maven.org before the
+      # Kotlin step runs.
+      - name: Deploy scip-java-bindings to Maven Central
+        run: mvn -B -ntp -Prelease -f bindings/java/pom.xml deploy
+        env:
+          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+
+      - name: Deploy scip-kotlin-bindings to Maven Central
+        run: mvn -B -ntp -Prelease -f bindings/kotlin/pom.xml deploy
+        env:
+          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+
   build-go-binaries:
     needs: publish
     permissions:
@@ -152,7 +192,7 @@ jobs:
           gh release upload "$TAG" "$ASSET.tar.gz" "$ASSET.tar.gz.sha256" --clobber
 
   finalize-release:
-    needs: [release-crate, build-go-binaries]
+    needs: [release-crate, build-go-binaries, publish-jvm-bindings]
     runs-on: ubuntu-latest
     permissions:
       contents: write