[kikoso]

gradle.properties is committed with empty mavenCentralUsername=, mavenCentralPassword= and signing.*= entries, which the publish workflow fills in with sed. Empty secret slots in a tracked file make it easy for someone publishing locally to fill them in and commit them by accident.

• gradle.properties: the five placeholders are replaced with a comment pointing to ~/.gradle/gradle.properties or ORG_GRADLE_PROJECT_* variables.
• publish.yml: the step now appends the five properties with printf instead of sed-replacing the placeholders. It is still the same file in the CI workspace, and the property names and secrets haven't changed.

This also fixes a latent bug: the old step only escaped the Sonatype password. A GPG key ID or password containing , or & would have broken the sed expression or written a wrong value. printf '%s' writes the values as is. I ran the new step locally with values containing , & and / and the output is correct.

Also checked: ./gradlew publishToMavenLocal still configures and builds all three AARs with no credentials set (signing is skipped as before). I could not run the real publish job.

[github-actions]

Coverage (unit tests)

No unit baseline recorded in coverage/history.csv yet, so this run only reports absolute numbers.

Module	Line %	Change	Branch %	Change
golden-testing	90.42%	new	58.00%	new
robolectric-testing	84.06%	new	51.87%	new
visual-testing	36.54%	new	25.07%	new
TOTAL	78.88%	new	44.10%	new

_{Line and branch coverage from unit test reports. History is recorded in coverage/history.csv after each merge to main.}