Always publish releases when deploying new versions to Maven

[ptornhult]

I'm noticing that there are 2 new version of the library on Maven: https://mvnrepository.com/artifact/com.microsoft.identity.client/msal
7.0.2 and 7.0.3

But the latest release in Github: https://github.com/AzureAD/microsoft-authentication-library-for-android/releases
is only 7.0.1

Since this library is one of the most important libraries we use to sign in and authenticate our app users we need to have a very high confidence in this project. Since I can't see what has been released (no release notes yet of the latest versions) I'm afraid to update and I'm even wondering if the releases are yours of if these new version are even yours?

I don't know what your release process is, but for all our sakes it would be best if you changed the process to only build and publish new artifacts to Maven when a new release is created in github so there are no more manual mistakes (if that is what is happening rn.?)

[ptornhult]

We are using Renovate bot (smilar to Dependabot) to search for and update our dependencies automatically. We are only using the repositories:

        mavenCentral()
        google()
        gradlePluginPortal()

And right now we're seeing that there is a 7.1.0 version available (reported by the automated process of Renovate + Gradle) but 7.1.0 is neither in the releases here nor can I see it in MVN search online (though that can be a sync issue). It leads me to believe that there is another source code project that updates the binaries and we should we not trust this Git project OR that the 7.1.0 binaries are published by an another untrusted source and we shouldn't trust the releases at all anymore?

Can you please clarify what's going on / provide a little more transparency on this subject?

If this is truly an open source project hosted on github, I would want the binaries to be created from the published source code here. If you have a private repo that you are building the releases from and then later syncing here. How can we be sure that the binary releases are actually the same code as you publish here?