feat: Jitpack distribution (#31)

* Add Jitpack config and allow beta releases

* Add ProGuard consumer rules for internal dependencies

Keep kotlinx.serialization, BouncyCastle, and OkHttp classes that are
used internally by the library. These rules ensure R8/ProGuard doesn't
strip classes needed at runtime when consumers minify their apps.

* Update README and release notes with Jitpack info

Author: redaranj

.github/workflows/release.yml

@@ -4,23 +4,23 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version for the release (e.g. 1.0.0)'
+        description: 'Version for the release (e.g. 1.0.0 or 1.0.0-beta.1)'
         required: true
         type: string
 
 jobs:
   build-and-release:
     runs-on: ubuntu-latest
-    
+
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
-    
+
     - name: Validate version format
       run: |
-        # Simple validation for version format
-        if [[ ! "${{ github.event.inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-          echo "::error::Version must be in format X.Y.Z (e.g., 1.0.0)"
+        # Validate version format: X.Y.Z or X.Y.Z-prerelease.N
+        if [[ ! "${{ github.event.inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+(\.[0-9]+)?)?$ ]]; then
+          echo "::error::Version must be in format X.Y.Z or X.Y.Z-suffix.N (e.g., 1.0.0 or 1.0.0-beta.1)"
           exit 1
         fi
     
@@ -29,6 +29,14 @@ jobs:
         git config user.name "GitHub Actions"
         git config user.email "actions@github.com"
 
+    - name: Get previous tag
+      id: prev_tag
+      run: |
+        git fetch --tags
+        PREV_TAG=$(git tag --sort=-version:refname | grep -v "^${{ github.event.inputs.version }}$" | head -n1)
+        echo "Previous tag: $PREV_TAG"
+        echo "tag=$PREV_TAG" >> $GITHUB_OUTPUT
+
     - name: Create tag
       run: |
         git tag ${{ github.event.inputs.version }}
@@ -85,28 +93,53 @@ jobs:
         body: |
           # C2PA Android Release ${{ github.event.inputs.version }}
 
-          ## Android Integration
+          ## Installation
+
+          The library is available from **JitPack** and **GitHub Packages**.
+
+          ### JitPack (Recommended)
+
+          ```gradle
+          // In settings.gradle
+          dependencyResolutionManagement {
+              repositories {
+                  maven { url 'https://jitpack.io' }
+              }
+          }
 
-          ### Gradle dependency
+          // In build.gradle
+          dependencies {
+              implementation 'com.github.contentauth:c2pa-android:${{ github.event.inputs.version }}'
+          }
+          ```
+
+          ### GitHub Packages
+
+          Requires authentication with a GitHub token:
+
+          ```gradle
+          // In build.gradle
+          dependencies {
+              implementation 'org.contentauth:c2pa:${{ github.event.inputs.version }}'
+          }
+          ```
 
-          Add the AAR library to your Android project:
+          ### Manual AAR
 
-          1. Download the AAR file from this release
-          2. Place it in your app's `libs` directory
-          3. Add to your `build.gradle`:
+          Download the AAR from this release and add to your project:
 
           ```gradle
           dependencies {
               implementation files('libs/c2pa-release.aar')
           }
           ```
 
-          ### Usage
+          ## Documentation
 
           See the [README.md](https://github.com/${{ github.repository }}) for detailed integration instructions and API documentation.
 
           ## What's Changed
 
-          See the [commit history](https://github.com/${{ github.repository }}/compare/{{ previousTag }}...${{ github.event.inputs.version }}) for a full list of changes.
+          See the [commit history](https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.tag }}...${{ github.event.inputs.version }}) for a full list of changes.
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -79,15 +79,31 @@ ndk.version=29.0.13599879
 
 ### Android (Gradle)
 
-You can add C2PA Android as a Gradle dependency:
+The library is available from two sources: **JitPack** (recommended for simplicity) and **GitHub Packages**.
+
+#### Option 1: JitPack (Recommended)
+
+Add JitPack to your repositories and include the dependency:
 
 ```gradle
+// In your settings.gradle or root build.gradle
+dependencyResolutionManagement {
+    repositories {
+        google()
+        mavenCentral()
+        maven { url 'https://jitpack.io' }
+    }
+}
+
+// In your app's build.gradle
 dependencies {
-    implementation "org.contentauth:c2pa:1.0.0"
+    implementation 'com.github.contentauth:c2pa-android:1.0.0'
 }
 ```
 
-Make sure to add the GitHub Packages repository to your project:
+#### Option 2: GitHub Packages
+
+GitHub Packages requires authentication. Add the repository and dependency:
 
 ```gradle
 // In your root build.gradle
@@ -105,6 +121,11 @@ allprojects {
         }
     }
 }
+
+// In your app's build.gradle
+dependencies {
+    implementation "org.contentauth:c2pa:1.0.0"
+}
 ```
 
 #### Development Workflow for Android

jitpack.yml

@@ -0,0 +1,9 @@
+jdk:
+  - openjdk17
+
+before_install:
+  - sdk install java 17.0.2-open
+  - sdk use java 17.0.2-open
+
+install:
+  - ./gradlew :library:publishToMavenLocal

library/consumer-rules.pro

@@ -10,4 +10,28 @@
 -keep interface org.contentauth.c2pa.SignCallback { *; }
 
 # Java 17 compatibility
--dontwarn java.lang.invoke.StringConcatFactory
+-dontwarn java.lang.invoke.StringConcatFactory
+
+# kotlinx.serialization (used internally for JSON parsing)
+-keepattributes *Annotation*, InnerClasses
+-dontnote kotlinx.serialization.**
+-keepclassmembers class kotlinx.serialization.json.** {
+    *** Companion;
+}
+-keepclasseswithmembers class kotlinx.serialization.json.** {
+    kotlinx.serialization.KSerializer serializer(...);
+}
+-keep,includedescriptorclasses class org.contentauth.c2pa.**$$serializer { *; }
+-keepclassmembers class org.contentauth.c2pa.** {
+    *** Companion;
+}
+
+# BouncyCastle (used internally for CSR generation)
+-keep class org.bouncycastle.** { *; }
+-dontwarn org.bouncycastle.**
+
+# OkHttp (used internally for web service signing)
+-dontwarn okhttp3.**
+-dontwarn okio.**
+-keep class okhttp3.** { *; }
+-keep interface okhttp3.** { *; }