Release 0.7.6

.github/workflows/publish-snapshots.yml

@@ -0,0 +1,50 @@
+name: Publish snapshots
+
+on:
+  push:
+    branches: [ dev ]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+
+      # A release version on dev (for example while a release is prepared) skips publishing
+      # instead of failing the job.
+      - name: Check SNAPSHOT version
+        id: version
+        run: |
+          if ./gradlew properties --no-daemon -q | grep -q 'version: .*-SNAPSHOT'; then
+            echo "snapshot=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Not a SNAPSHOT version, skipping snapshot publishing."
+            echo "snapshot=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Import GPG signing key
+        if: steps.version.outputs.snapshot == 'true'
+        run: |
+          echo -e "${{ secrets.OSSRH_GPG_SECRET_KEY }}" | gpg --batch --import
+          gpg --list-secret-keys --keyid-format LONG
+
+      - name: Publish to Sonatype snapshots
+        if: steps.version.outputs.snapshot == 'true'
+        env:
+          OSSRH_USER: ${{ secrets.OSSRH_USER_TOKEN_ID }}
+          OSSRH_PASSWORD: ${{ secrets.OSSRH_USER_TOKEN_SECRET }}
+        run: >-
+          ./gradlew
+          -Psigning.gnupg.keyName=${{ secrets.OSSRH_GPG_SECRET_KEY_NAME }}
+          -Psigning.gnupg.executable=gpg
+          -Psigning.gnupg.passphrase=${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
+          publish

.github/workflows/release.yml

@@ -45,6 +45,45 @@ jobs:
           files: '*/build/libs/*'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
+  publish-jars:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+
+      - name: Assert release (non-SNAPSHOT) version
+        run: |
+          if ./gradlew properties --no-daemon -q | grep -q 'version: .*-SNAPSHOT'; then
+            echo "Refusing to release: project version is still -SNAPSHOT" >&2
+            exit 1
+          fi
+
+      - name: Import GPG signing key
+        run: |
+          echo -e "${{ secrets.OSSRH_GPG_SECRET_KEY }}" | gpg --batch --import
+          gpg --list-secret-keys --keyid-format LONG
+
+      - name: Publish and close staging repository
+        env:
+          OSSRH_USER: ${{ secrets.OSSRH_USER_TOKEN_ID }}
+          OSSRH_PASSWORD: ${{ secrets.OSSRH_USER_TOKEN_SECRET }}
+        run: >-
+          ./gradlew
+          -Psigning.gnupg.keyName=${{ secrets.OSSRH_GPG_SECRET_KEY_NAME }}
+          -Psigning.gnupg.executable=gpg
+          -Psigning.gnupg.passphrase=${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
+          publish closeAndReleaseSonatypeStagingRepository
+
   prepare-matrix:
     name: Prepare Matrix Output
     runs-on: ubuntu-latest

build.gradle.kts

@@ -1,9 +1,11 @@
 import org.radarbase.gradle.plugin.radarKotlin
+import org.radarbase.gradle.plugin.radarPublishing
 
 plugins {
     alias(libs.plugins.radar.root.project)
     alias(libs.plugins.radar.dependency.management)
     alias(libs.plugins.radar.kotlin) apply false
+    alias(libs.plugins.radar.publishing) apply false
 }
 
 repositories {
@@ -17,9 +19,41 @@ radarRootProject {
     gradleVersion.set(libs.versions.gradle)
 }
 
+val githubRepoName = "RADAR-base/RADAR-REST-Connector"
+val githubProjectUrl = "https://github.com/$githubRepoName"
+
+val publishedSubprojects = setOf("google-health-library")
+
 subprojects {
     apply(plugin = "org.radarbase.radar-kotlin")
 
+    if (name in publishedSubprojects) {
+        apply(plugin = "org.radarbase.radar-publishing")
+        radarPublishing {
+            githubUrl.set(githubProjectUrl)
+            developers {
+                developer {
+                    id.set("yatharthranjan")
+                    name.set("Yatharth Ranjan")
+                    email.set("yatharth.ranjan@kcl.ac.uk")
+                    organization.set("King's College London")
+                }
+                developer {
+                    id.set("mpgxvii")
+                    name.set("Pauline Conde")
+                    email.set("mpgxvii@gmail.com")
+                    organization.set("King's College London")
+                }
+                developer {
+                    id.set("this-Aditya")
+                    name.set("Aditya Mishra")
+                    email.set("aditya.mishra@kcl.ac.uk")
+                    organization.set("King's College London")
+                }
+            }
+        }
+    }
+
     // --- Vulnerability fixes start ---
     dependencies {
         plugins.withType<JavaPlugin> {
@@ -30,6 +64,12 @@ subprojects {
                 add("implementation", rootProject.libs.commons.lang3) {
                     because("Force safe version of commons-lang3 across all modules")
                 }
+                add("implementation", rootProject.libs.httpcore5) {
+                    because("CVE-2026-54399: firebase-admin pulls in a vulnerable httpcore5")
+                }
+                add("implementation", rootProject.libs.httpcore5.h2) {
+                    because("CVE-2026-54428: firebase-admin pulls in a vulnerable httpcore5-h2")
+                }
             }
         }
     }

google-health-library/build.gradle

@@ -0,0 +1,17 @@
+description = "Google Health library with utility components to be used in RADAR-Pushendpoint"
+
+dependencies {
+    implementation libs.kotlin.stdlib
+
+    api libs.radar.schemas.commons
+
+    implementation libs.jackson.annotations
+
+    api libs.jackson.databind
+
+    api libs.avro
+
+    implementation libs.jackson.datatype.jsr310
+
+    testImplementation libs.kotlin.test
+}

google-health-library/src/main/kotlin/org/radarbase/googlehealth/converter/AvroConverter.kt

@@ -0,0 +1,33 @@
+/*
+ * Copyright 2026 King's College London
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.radarbase.googlehealth.converter
+
+import com.fasterxml.jackson.databind.JsonNode
+import org.apache.avro.specific.SpecificRecord
+import org.radarbase.googlehealth.user.User
+import java.io.IOException
+
+interface AvroConverter {
+
+    val topic: String
+
+    @Throws(IOException::class)
+    fun convert(
+        tree: JsonNode,
+        user: User,
+    ): List<Pair<SpecificRecord, SpecificRecord>>
+}

google-health-library/src/main/kotlin/org/radarbase/googlehealth/converter/GoogleHealthActivityLevelAvroConverter.kt

@@ -0,0 +1,60 @@
+/*
+ * Copyright 2026 King's College London
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.radarbase.googlehealth.converter
+
+import com.fasterxml.jackson.databind.JsonNode
+import org.apache.avro.specific.SpecificRecord
+import org.radarbase.googlehealth.user.User
+import org.radarbase.googlehealth.util.googleHealthActivityLevel
+import org.radarcns.push.googlehealth.GoogleHealthActivityLevelType
+
+/**
+ * Converts `activity-level` data points: the activity level the user sustained over an interval,
+ * one minute long in practice, reported for every interval of the day. The sedentary intervals are
+ * also reported grouped into longer periods, see [GoogleHealthSedentaryPeriodAvroConverter].
+ */
+class GoogleHealthActivityLevelAvroConverter(topic: String) : GoogleHealthAvroConverter(topic) {
+    override fun convertDataPoint(
+        point: JsonNode,
+        user: User,
+    ): List<Pair<SpecificRecord, SpecificRecord>> {
+        val data = point["activityLevel"] ?: return emptyList()
+        val (start, end) = parseInterval(data) ?: return emptyList()
+        val record = googleHealthActivityLevel {
+            time = epochSeconds(start)
+            timeReceived = nowEpochSeconds()
+            timeInterval = (end.epochSecond - start.epochSecond).toInt().coerceAtLeast(0)
+            level = mapLevel(data["activityLevelType"]?.asText())
+        }
+        return listOf(user.observationKey to record)
+    }
+
+    /**
+     * Google's `ACTIVITY_LEVEL_TYPE_UNSPECIFIED` is kept as its own symbol, it means Google itself
+     * did not classify the interval. Any other symbol, including ones Google adds later, is
+     * `UNKNOWN`.
+     */
+    private fun mapLevel(text: String?): GoogleHealthActivityLevelType = when (text) {
+        "SEDENTARY" -> GoogleHealthActivityLevelType.SEDENTARY
+        "LIGHTLY_ACTIVE" -> GoogleHealthActivityLevelType.LIGHTLY_ACTIVE
+        "MODERATELY_ACTIVE" -> GoogleHealthActivityLevelType.MODERATELY_ACTIVE
+        "VERY_ACTIVE" -> GoogleHealthActivityLevelType.VERY_ACTIVE
+        "ACTIVITY_LEVEL_TYPE_UNSPECIFIED" ->
+            GoogleHealthActivityLevelType.ACTIVITY_LEVEL_TYPE_UNSPECIFIED
+        else -> GoogleHealthActivityLevelType.UNKNOWN
+    }
+}