Publish executables for pkldoc, pkl-codegen-java, pkl-codegen-kotlin (#1023)

This adds logic to build and publish the other executables related to Pkl.

These are:

* pkl-doc
* pkl-codegen-kotlin
* pkl-codegen-java

pkl-codegen-kotlin and pkl-codegen-java are published as executable JARs, whereas pkldoc is published both as an executable JAR, and also native executables (matching the set of os/arch supported by Pkl).

The reason this only publishes executable JARs for pkl-codegen-kotlin and pkl-codegen-java is because we expect that the Java requirement is not a problem for these users, and that the native executable provides negligible added value.

As part of this, the following changes are made:

* Introduce `pklJavaExecutable` plugin, which sets up building and publishing of executable JAR.
* Introduce `pklNativeExecutable` plugin, which sets up building and publishing of native executables.
* Introduce `NativeImageBuild` Gradle task, which knows how to build native-image executables.
* Introduce `ExecutableSpec` extension, for projects that publish executables to configure how those executables should be published.
* `./griddles buildNative`, by default, will only build the executable of the host OS/Arch, and will no longer cross-build.
* The target arch of `./gradlew buildNative` can be changed using `-Dpkl.targetArch=<aarch64|amd64>`.
* On linux/amd64 only, with `./gradlew buildNative`, a statically linked executable can be built using `-Dpkl.musl=true`
* Make `javaExecutable` a dependency of `assemble`
* Make `testStartJavaExecutable` a dependency of `check`
* Change name `pklNativeBuild` to `pklNativeLifecycle` to better match the plugin's purpose
* Remove Truffle SVM classes from main source set (don't publish these classes as part of the pkl-cli JAR)
* Change CircleCI definition to publish new executables
* Change CircleCI definition to call `buildNative` instead of individual task names

buildSrc/src/main/kotlin/BuildInfo.kt

@@ -107,6 +107,18 @@ open class BuildInfo(private val project: Project) {
     }
   }
 
+  /** The target architecture to build, defaulting to the system architecture. */
+  val targetArch by lazy { System.getProperty("pkl.targetArch") ?: arch }
+
+  /** Tells if this is a cross-arch build (e.g. targeting amd64 when on an aarch64 machine). */
+  val isCrossArch by lazy { arch != targetArch }
+
+  /** Tells if cross-arch builds are supported on this machine. */
+  val isCrossArchSupported by lazy { os.isMacOsX }
+
+  /** Whether to build native executables using the musl toolchain or not. */
+  val musl: Boolean by lazy { java.lang.Boolean.getBoolean("pkl.musl") }
+
   /** Same logic as [org.gradle.internal.os.OperatingSystem#arch], which is protected. */
   val arch: String by lazy {
     when (val arch = System.getProperty("os.arch")) {

buildSrc/src/main/kotlin/ExecutableSpec.kt

@@ -0,0 +1,49 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.api.provider.Property
+
+abstract class ExecutableSpec {
+  /** The main entrypoint Java class of the executable. */
+  abstract val mainClass: Property<String>
+
+  /**
+   * The name of the native executable.
+   *
+   * Not required if not building a native executable.
+   */
+  abstract val name: Property<String>
+
+  /** The name of the Java executable. */
+  abstract val javaName: Property<String>
+
+  /** The name of the executable that shows in the description when published to Maven. */
+  abstract val documentationName: Property<String>
+
+  /**
+   * The base name of the Maven publication.
+   *
+   * This becomes the base name of the Artifact ID, with the os and arch suffixed.
+   *
+   * For example, `pkl` becomes `pkl-macos-aarch` for the macOS/aarch64 variant.
+   */
+  abstract val publicationName: Property<String>
+
+  /** The name of the artifact ID for the Java executable. */
+  abstract val javaPublicationName: Property<String>
+
+  /** The website for this executable. */
+  abstract val website: Property<String>
+}

buildSrc/src/main/kotlin/NativeImageBuild.kt

@@ -0,0 +1,169 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import javax.inject.Inject
+import org.gradle.api.DefaultTask
+import org.gradle.api.file.ConfigurableFileCollection
+import org.gradle.api.provider.ListProperty
+import org.gradle.api.provider.Property
+import org.gradle.api.provider.Provider
+import org.gradle.api.services.BuildService
+import org.gradle.api.services.BuildServiceParameters
+import org.gradle.api.tasks.ClasspathNormalizer
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.InputFiles
+import org.gradle.api.tasks.OutputFile
+import org.gradle.api.tasks.PathSensitivity
+import org.gradle.api.tasks.TaskAction
+import org.gradle.kotlin.dsl.registerIfAbsent
+import org.gradle.kotlin.dsl.withNormalizer
+import org.gradle.process.ExecOperations
+
+enum class Architecture {
+  AMD64,
+  AARCH64,
+}
+
+abstract class NativeImageBuildService : BuildService<BuildServiceParameters.None>
+
+abstract class NativeImageBuild : DefaultTask() {
+  @get:Input abstract val imageName: Property<String>
+
+  @get:Input abstract val extraNativeImageArgs: ListProperty<String>
+
+  @get:Input abstract val arch: Property<Architecture>
+
+  @get:Input abstract val mainClass: Property<String>
+
+  @get:InputFiles abstract val classpath: ConfigurableFileCollection
+
+  private val outputDir = project.layout.buildDirectory.dir("executable")
+
+  @get:OutputFile val outputFile = outputDir.flatMap { it.file(imageName) }
+
+  @get:Inject protected abstract val execOperations: ExecOperations
+
+  private val graalVm: Provider<BuildInfo.GraalVm> =
+    arch.map { a ->
+      when (a) {
+        Architecture.AMD64 -> buildInfo.graalVmAmd64
+        Architecture.AARCH64 -> buildInfo.graalVmAarch64
+      }
+    }
+
+  private val buildInfo: BuildInfo = project.extensions.getByType(BuildInfo::class.java)
+
+  private val nativeImageCommandName =
+    if (buildInfo.os.isWindows) "native-image.cmd" else "native-image"
+
+  private val nativeImageExecutable = graalVm.map { "${it.baseDir}/bin/$nativeImageCommandName" }
+
+  private val extraArgsFromProperties by lazy {
+    System.getProperties()
+      .filter { it.key.toString().startsWith("pkl.native") }
+      .map { "${it.key}=${it.value}".substring("pkl.native".length) }
+  }
+
+  private val buildService =
+    project.gradle.sharedServices.registerIfAbsent(
+      "nativeImageBuildService",
+      NativeImageBuildService::class,
+    ) {
+      maxParallelUsages.set(1)
+    }
+
+  init {
+    // ensure native-image builds run in serial (prevent `gw buildNative` from consuming all host
+    // CPU resources).
+    usesService(buildService)
+
+    group = "build"
+
+    inputs
+      .files(classpath)
+      .withPropertyName("runtimeClasspath")
+      .withNormalizer(ClasspathNormalizer::class)
+    inputs
+      .files(nativeImageExecutable)
+      .withPropertyName("graalVmNativeImage")
+      .withPathSensitivity(PathSensitivity.ABSOLUTE)
+  }
+
+  @TaskAction
+  protected fun run() {
+    execOperations.exec {
+      val exclusions =
+        listOf(buildInfo.libs.findLibrary("graalSdk").get()).map { it.get().module.name }
+
+      executable = nativeImageExecutable.get()
+      workingDir(outputDir)
+
+      args = buildList {
+        // must be emitted before any experimental options are used
+        add("-H:+UnlockExperimentalVMOptions")
+        // currently gives a deprecation warning, but we've been told
+        // that the "initialize everything at build time" *CLI* option is likely here to stay
+        add("--initialize-at-build-time=")
+        // needed for messagepack-java (see https://github.com/msgpack/msgpack-java/issues/600)
+        add("--initialize-at-run-time=org.msgpack.core.buffer.DirectBufferAccess")
+        add("--no-fallback")
+        add("-H:IncludeResources=org/pkl/core/stdlib/.*\\.pkl")
+        add("-H:IncludeResources=org/jline/utils/.*")
+        add("-H:IncludeResourceBundles=org.pkl.core.errorMessages")
+        add("-H:IncludeResourceBundles=org.pkl.parser.errorMessages")
+        add("-H:IncludeResources=org/pkl/commons/cli/PklCARoots.pem")
+        add("-H:Class=${mainClass.get()}")
+        add("-o")
+        add(imageName.get())
+        // the actual limit (currently) used by native-image is this number + 1400 (idea is to
+        // compensate for Truffle's own nodes)
+        add("-H:MaxRuntimeCompileMethods=1800")
+        add("-H:+EnforceMaxRuntimeCompileMethods")
+        add("--enable-url-protocols=http,https")
+        add("-H:+ReportExceptionStackTraces")
+        // disable automatic support for JVM CLI options (puts our main class in full control of
+        // argument parsing)
+        add("-H:-ParseRuntimeOptions")
+        // quick build mode: 40% faster compilation, 20% smaller (but presumably also slower)
+        // executable
+        if (!buildInfo.isReleaseBuild) {
+          add("-Ob")
+        }
+        if (buildInfo.isNativeArch) {
+          add("-march=native")
+        } else {
+          add("-march=compatibility")
+        }
+        // native-image rejects non-existing class path entries -> filter
+        add("--class-path")
+        val pathInput =
+          classpath.filter {
+            it.exists() && !exclusions.any { exclude -> it.name.contains(exclude) }
+          }
+        add(pathInput.asPath)
+        // make sure dev machine stays responsive (15% slowdown on my laptop)
+        val processors =
+          Runtime.getRuntime().availableProcessors() /
+            if (buildInfo.os.isMacOsX && !buildInfo.isCiBuild) 4 else 1
+        add("-J-XX:ActiveProcessorCount=${processors}")
+        // Pass through all `HOMEBREW_` prefixed environment variables to allow build with shimmed
+        // tools.
+        addAll(environment.keys.filter { it.startsWith("HOMEBREW_") }.map { "-E$it" })
+        addAll(extraNativeImageArgs.get())
+        addAll(extraArgsFromProperties)
+      }
+    }
+  }
+}

buildSrc/src/main/kotlin/pklJavaExecutable.gradle.kts

@@ -0,0 +1,132 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import kotlin.io.path.createDirectories
+import kotlin.io.path.writeText
+import org.gradle.kotlin.dsl.support.serviceOf
+
+plugins {
+  id("pklJavaLibrary")
+  id("pklPublishLibrary")
+  id("com.github.johnrengelman.shadow")
+}
+
+val executableSpec = project.extensions.create("executable", ExecutableSpec::class.java)
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val javaExecutable by
+  tasks.registering(ExecutableJar::class) {
+    group = "build"
+    dependsOn(tasks.jar)
+    inJar = tasks.shadowJar.flatMap { it.archiveFile }
+    val effectiveJavaName =
+      executableSpec.javaName.map { name -> if (buildInfo.os.isWindows) "$name.bat" else name }
+    outJar = layout.buildDirectory.dir("executable").flatMap { it.file(effectiveJavaName) }
+
+    // uncomment for debugging
+    // jvmArgs.addAll("-ea", "-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=5005")
+  }
+
+fun Task.setupTestStartJavaExecutable(launcher: Provider<JavaLauncher>? = null) {
+  group = "verification"
+  dependsOn(javaExecutable)
+
+  // dummy output to satisfy up-to-date check
+  val outputFile = layout.buildDirectory.file("testStartJavaExecutable/$name")
+  outputs.file(outputFile)
+
+  val execOutput =
+    providers.exec {
+      val executablePath = javaExecutable.get().outputs.files.singleFile
+      if (launcher?.isPresent == true) {
+        commandLine(
+          launcher.get().executablePath.asFile.absolutePath,
+          "-jar",
+          executablePath.absolutePath,
+          "--version",
+        )
+      } else {
+        commandLine(executablePath.absolutePath, "--version")
+      }
+    }
+
+  doLast {
+    val outputText = execOutput.standardOutput.asText.get()
+    if (!outputText.contains(buildInfo.pklVersionNonUnique)) {
+      throw GradleException(
+        "Expected version output to contain current version (${buildInfo.pklVersionNonUnique}), but got '$outputText'"
+      )
+    }
+    outputFile.get().asFile.toPath().apply {
+      try {
+        parent.createDirectories()
+      } catch (ignored: java.nio.file.FileAlreadyExistsException) {}
+      writeText("OK")
+    }
+  }
+}
+
+val testStartJavaExecutable by tasks.registering { setupTestStartJavaExecutable() }
+
+// Setup `testStartJavaExecutable` tasks for multi-JDK testing.
+val testStartJavaExecutableOnOtherJdks =
+  buildInfo.jdkTestRange.map { jdkTarget ->
+    tasks.register("testStartJavaExecutableJdk${jdkTarget.asInt()}") {
+      val toolChainService: JavaToolchainService = serviceOf()
+      val launcher = toolChainService.launcherFor { languageVersion = jdkTarget }
+      setupTestStartJavaExecutable(launcher)
+    }
+  }
+
+tasks.assemble { dependsOn(javaExecutable) }
+
+tasks.check {
+  dependsOn(testStartJavaExecutable)
+  if (buildInfo.multiJdkTesting) {
+    dependsOn(testStartJavaExecutableOnOtherJdks)
+  }
+}
+
+publishing {
+  publications {
+    // need to put in `afterEvaluate` because `artifactId` cannot be set lazily.
+    project.afterEvaluate {
+      register<MavenPublication>("javaExecutable") {
+        artifactId = executableSpec.javaPublicationName.get()
+
+        artifact(javaExecutable.map { it.outputs.files.singleFile }) {
+          classifier = null
+          extension = "jar"
+          builtBy(javaExecutable)
+        }
+
+        pom {
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              """
+            $name executable for Java.
+            Can be executed directly, or with `java -jar <path/to/jpkl>`.
+            Requires Java 17 or higher.
+            """
+                .trimIndent()
+            }
+        }
+      }
+    }
+  }
+}
+
+signing { project.afterEvaluate { sign(publishing.publications["javaExecutable"]) } }

buildSrc/src/main/kotlin/pklNativeBuild.gradle.kts

@@ -1,22 +0,0 @@
-/*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-val assembleNative by tasks.registering {}
-
-val testNative by tasks.registering {}
-
-val checkNative by tasks.registering { dependsOn(testNative) }
-
-val buildNative by tasks.registering { dependsOn(assembleNative, checkNative) }

buildSrc/src/main/kotlin/pklNativeExecutable.gradle.kts

@@ -0,0 +1,291 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import kotlin.io.path.createDirectories
+import kotlin.io.path.writeText
+
+plugins {
+  id("pklGraalVm")
+  id("pklJavaLibrary")
+  id("pklNativeLifecycle")
+  id("pklPublishLibrary")
+  id("com.github.johnrengelman.shadow")
+}
+
+// assumes that `pklJavaExecutable` is also applied
+val executableSpec = project.extensions.getByType<ExecutableSpec>()
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val stagedMacAmd64Executable: Configuration by configurations.creating
+val stagedMacAarch64Executable: Configuration by configurations.creating
+val stagedLinuxAmd64Executable: Configuration by configurations.creating
+val stagedLinuxAarch64Executable: Configuration by configurations.creating
+val stagedAlpineLinuxAmd64Executable: Configuration by configurations.creating
+val stagedWindowsAmd64Executable: Configuration by configurations.creating
+
+dependencies {
+  fun executableFile(suffix: String) =
+    files(
+      layout.buildDirectory.dir("executable").map { dir ->
+        dir.file(executableSpec.name.map { "$it-$suffix" })
+      }
+    )
+  stagedMacAarch64Executable(executableFile("macos-aarch64"))
+  stagedMacAmd64Executable(executableFile("macos-amd64"))
+  stagedLinuxAmd64Executable(executableFile("linux-amd64"))
+  stagedLinuxAarch64Executable(executableFile("linux-aarch64"))
+  stagedAlpineLinuxAmd64Executable(executableFile("alpine-linux-amd64"))
+  stagedWindowsAmd64Executable(executableFile("windows-amd64.exe"))
+}
+
+private fun NativeImageBuild.amd64() {
+  arch = Architecture.AMD64
+  dependsOn(":installGraalVmAmd64")
+}
+
+private fun NativeImageBuild.aarch64() {
+  arch = Architecture.AARCH64
+  dependsOn(":installGraalVmAarch64")
+}
+
+private fun NativeImageBuild.setClasspath() {
+  classpath.from(sourceSets.main.map { it.output })
+  classpath.from(
+    project(":pkl-commons-cli").extensions.getByType(SourceSetContainer::class)["svm"].output
+  )
+  classpath.from(configurations.runtimeClasspath)
+}
+
+val macExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-macos-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+  }
+
+val macExecutableAarch64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-macos-aarch64" }
+    mainClass = executableSpec.mainClass
+    aarch64()
+    setClasspath()
+  }
+
+val linuxExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-linux-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+  }
+
+val linuxExecutableAarch64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-linux-aarch64" }
+    mainClass = executableSpec.mainClass
+    aarch64()
+    setClasspath()
+    // Ensure compatibility for kernels with page size set to 4k, 16k and 64k
+    // (e.g. Raspberry Pi 5, Asahi Linux)
+    extraNativeImageArgs.add("-H:PageSize=65536")
+  }
+
+val alpineExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-alpine-linux-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+    extraNativeImageArgs.addAll(listOf("--static", "--libc=musl"))
+  }
+
+val windowsExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-windows-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+    extraNativeImageArgs.add("-Dfile.encoding=UTF-8")
+  }
+
+val assembleNative by tasks.existing
+
+val testStartNativeExecutable by
+  tasks.registering {
+    dependsOn(assembleNative)
+
+    // dummy file for up-to-date checking
+    val outputFile = project.layout.buildDirectory.file("testStartNativeExecutable/output.txt")
+    outputs.file(outputFile)
+
+    val execOutput =
+      providers.exec { commandLine(assembleNative.get().outputs.files.singleFile, "--version") }
+
+    doLast {
+      val outputText = execOutput.standardOutput.asText.get()
+      if (!outputText.contains(buildInfo.pklVersionNonUnique)) {
+        throw GradleException(
+          "Expected version output to contain current version (${buildInfo.pklVersionNonUnique}), but got '$outputText'"
+        )
+      }
+      outputFile.get().asFile.toPath().apply {
+        try {
+          parent.createDirectories()
+        } catch (ignored: java.nio.file.FileAlreadyExistsException) {}
+        writeText("OK")
+      }
+    }
+  }
+
+// Expose underlying task's outputs
+private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
+  dependsOn(other)
+  outputs.files(other)
+}
+
+val testNative by tasks.existing { dependsOn(testStartNativeExecutable) }
+
+val assembleNativeMacOsAarch64 by tasks.existing { wraps(macExecutableAarch64) }
+
+val assembleNativeMacOsAmd64 by tasks.existing { wraps(macExecutableAmd64) }
+
+val assembleNativeLinuxAarch64 by tasks.existing { wraps(linuxExecutableAarch64) }
+
+val assembleNativeLinuxAmd64 by tasks.existing { wraps(linuxExecutableAmd64) }
+
+val assembleNativeAlpineLinuxAmd64 by tasks.existing { wraps(alpineExecutableAmd64) }
+
+val assembleNativeWindowsAmd64 by tasks.existing { wraps(windowsExecutableAmd64) }
+
+publishing {
+  publications {
+    // need to put in `afterEvaluate` because `artifactId` cannot be set lazily.
+    project.afterEvaluate {
+      create<MavenPublication>("macExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-macos-amd64"
+        artifact(stagedMacAmd64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedMacAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-macos-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for macOS/amd64."
+            }
+        }
+      }
+
+      create<MavenPublication>("macExecutableAarch64") {
+        artifactId = "${executableSpec.publicationName.get()}-macos-aarch64"
+        artifact(stagedMacAarch64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedMacAarch64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-macos-aarch64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for macOS/aarch64."
+            }
+        }
+      }
+
+      create<MavenPublication>("linuxExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-linux-amd64"
+        artifact(stagedLinuxAmd64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedLinuxAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-linux-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for linux/amd64."
+            }
+        }
+      }
+
+      create<MavenPublication>("linuxExecutableAarch64") {
+        artifactId = "${executableSpec.publicationName.get()}-linux-aarch64"
+        artifact(stagedLinuxAarch64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedLinuxAarch64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-linux-aarch64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for linux/aarch64."
+            }
+        }
+      }
+
+      create<MavenPublication>("alpineLinuxExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-alpine-linux-amd64"
+        artifact(stagedAlpineLinuxAmd64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedAlpineLinuxAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-alpine-linux-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for linux/amd64 and statically linked to musl."
+            }
+        }
+      }
+
+      create<MavenPublication>("windowsExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-windows-amd64"
+        artifact(stagedWindowsAmd64Executable.singleFile) {
+          classifier = null
+          extension = "exe"
+          builtBy(stagedWindowsAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-windows-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for windows/amd64."
+            }
+        }
+      }
+    }
+  }
+}
+
+signing {
+  project.afterEvaluate {
+    sign(publishing.publications["linuxExecutableAarch64"])
+    sign(publishing.publications["linuxExecutableAmd64"])
+    sign(publishing.publications["macExecutableAarch64"])
+    sign(publishing.publications["macExecutableAmd64"])
+    sign(publishing.publications["alpineLinuxExecutableAmd64"])
+    sign(publishing.publications["windowsExecutableAmd64"])
+  }
+}

buildSrc/src/main/kotlin/pklNativeLifecycle.gradle.kts

@@ -0,0 +1,129 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+val assembleNativeMacOsAarch64 by tasks.registering { group = "build" }
+
+val assembleNativeMacOsAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeLinuxAarch64 by tasks.registering { group = "build" }
+
+val assembleNativeLinuxAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeAlpineLinuxAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeWindowsAmd64 by tasks.registering { group = "build" }
+
+val testNativeMacOsAarch64 by tasks.registering { group = "verification" }
+
+val testNativeMacOsAmd64 by tasks.registering { group = "verification" }
+
+val testNativeLinuxAarch64 by tasks.registering { group = "verification" }
+
+val testNativeLinuxAmd64 by tasks.registering { group = "verification" }
+
+val testNativeAlpineLinuxAmd64 by tasks.registering { group = "verification" }
+
+val testNativeWindowsAmd64 by tasks.registering { group = "verification" }
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
+  dependsOn(other)
+  outputs.files(other)
+}
+
+val assembleNative by
+  tasks.registering {
+    group = "build"
+
+    if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
+      throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
+    }
+
+    when {
+      buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
+        wraps(assembleNativeMacOsAarch64)
+      }
+      buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
+        wraps(assembleNativeMacOsAmd64)
+      }
+      buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
+        wraps(assembleNativeLinuxAarch64)
+      }
+      buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
+        if (buildInfo.musl) wraps(assembleNativeAlpineLinuxAmd64)
+        else wraps(assembleNativeLinuxAmd64)
+      }
+      buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
+        wraps(assembleNativeWindowsAmd64)
+      }
+      buildInfo.musl -> {
+        throw GradleException("Building musl on ${buildInfo.os} is not supported")
+      }
+      else -> {
+        throw GradleException(
+          "Unsupported os/arch pair: ${buildInfo.os.name}/${buildInfo.targetArch}"
+        )
+      }
+    }
+  }
+
+val testNative by
+  tasks.registering {
+    group = "verification"
+
+    if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
+      throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
+    }
+
+    when {
+      buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
+        dependsOn(testNativeMacOsAarch64)
+      }
+      buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
+        dependsOn(testNativeMacOsAmd64)
+      }
+      buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
+        dependsOn(testNativeLinuxAarch64)
+      }
+      buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
+        if (buildInfo.musl) dependsOn(testNativeAlpineLinuxAmd64)
+        else dependsOn(testNativeLinuxAmd64)
+      }
+      buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
+        dependsOn(testNativeWindowsAmd64)
+      }
+      buildInfo.musl -> {
+        throw GradleException("Building musl on ${buildInfo.os} is not supported")
+      }
+      else -> {
+        throw GradleException(
+          "Unsupported os/arch pair: ${buildInfo.os.name}/${buildInfo.targetArch}"
+        )
+      }
+    }
+  }
+
+val checkNative by
+  tasks.registering {
+    group = "verification"
+    dependsOn(testNative)
+  }
+
+val buildNative by
+  tasks.registering {
+    group = "build"
+    dependsOn(assembleNative, checkNative)
+  }