Entertech · wk1995 · Jul 22, 2026 · Jul 6, 2026 · Jul 6, 2026 · Jul 6, 2026
diff --git a/.github/scripts/normalize_signing_key_id_test.py b/.github/scripts/normalize_signing_key_id_test.py
@@ -16,7 +16,7 @@ def test_converts_fingerprint_to_long_key_id(self):
         )
 
     def test_rejects_non_hex_values(self):
-        self.assertEqual(normalize_signing_key_id("wk1995 <1226426603@qq.com>"), "")
+        self.assertEqual(normalize_signing_key_id("Developer <dev@example.com>"), "")
         self.assertEqual(normalize_signing_key_id("not-a-key-id"), "")
 
     def test_shell_exports_clear_all_gradle_key_id_aliases_for_invalid_value(self):

diff --git a/.github/scripts/publish_plugin_central_workflow_test.py b/.github/scripts/publish_plugin_central_workflow_test.py
@@ -97,6 +97,30 @@ def test_central_publish_is_gated_by_pre_publish_vs_main_version(self):
         self.assertIn("== \"true\"", merge)
         self.assertIn("does not require Central publish; merging directly", merge)
 
+    def test_release_sync_updates_readme_and_root_build_after_publish(self):
+        sync = step_block("Sync README release version")
+
+        self.assertIn("--root-build-file build.gradle.kts", sync)
+        self.assertIn("README.md build.gradle.kts", sync)
+        self.assertIn("git add plugin_base/build.gradle.kts README.md build.gradle.kts", sync)
+        self.assertIn("Update publish plugin usage version", sync)
+
+    def test_ci_mode_publishes_plugin_snapshot_without_release_steps(self):
+        text = workflow_text()
+        snapshot = step_block("Publish snapshot to Central snapshots")
+        resolve = step_block("Resolve snapshot version")
+
+        self.assertIn("publish_mode:", text)
+        self.assertIn("github.event.inputs.publish_mode != 'ci'", text)
+        self.assertIn("ci_snapshot:", text)
+        self.assertIn("github.event.inputs.publish_mode == 'ci'", text)
+        self.assertIn('snapshot_version="${base_version}-SNAPSHOT"', resolve)
+        self.assertIn("plugin_base/build.gradle.kts", resolve)
+        self.assertIn("publishAllPublicationsToCentralSnapshotsRepository", snapshot)
+        self.assertIn("-PcentralReleaseType=snapshot", snapshot)
+        self.assertNotIn("sync_readme_publish_version.py", snapshot)
+        self.assertNotIn("git tag", snapshot)
+
 
 class PublishPluginPrCheckWorkflowTest(unittest.TestCase):
     def test_version_bump_only_runs_when_plugin_base_changed(self):

diff --git a/.github/scripts/reusable_publish_workflow_test.py b/.github/scripts/reusable_publish_workflow_test.py
@@ -0,0 +1,99 @@
+import re
+import unittest
+from pathlib import Path
+
+
+WORKFLOW = Path(__file__).resolve().parents[1] / "workflows" / "publish.yml"
+
+
+def workflow_text():
+    return WORKFLOW.read_text(encoding="utf-8")
+
+
+def step_block(name):
+    text = workflow_text()
+    match = re.search(
+        rf"(?ms)^      - name: {re.escape(name)}\n(?P<body>.*?)(?=^      - name: |\Z)",
+        text,
+    )
+    if match is None:
+        raise AssertionError(f"Missing workflow step: {name}")
+    return match.group("body")
+
+
+class ReusablePublishWorkflowTest(unittest.TestCase):
+    def test_publish_target_input_supports_three_modes(self):
+        text = workflow_text()
+        validation = step_block("Validate publish inputs")
+
+        self.assertIn("publish_target:", text)
+        self.assertIn('default: "github_packages"', text)
+        self.assertIn("publish_mode:", text)
+        self.assertIn("sync_readme:", text)
+        self.assertIn("contents: write", text)
+        self.assertIn("central|github_packages|all", validation)
+        self.assertIn("publish_target must be central, github_packages, or all", validation)
+        self.assertIn("publish_mode must be release or ci", validation)
+        self.assertIn("publish_mode=ci only supports publish_target=central", validation)
+
+    def test_publish_version_resolution_supports_ci_snapshots(self):
+        resolve = step_block("Resolve publish version")
+
+        self.assertIn('effective_version="${effective_version}-SNAPSHOT"', resolve)
+        self.assertIn('central_release_type="snapshot"', resolve)
+        self.assertIn('sync_readme_effective=false', resolve)
+        self.assertIn("publish_mode=release must not use a -SNAPSHOT version", resolve)
+        self.assertIn("EFFECTIVE_PUBLISH_VERSION", resolve)
+        self.assertIn("CENTRAL_RELEASE_TYPE", resolve)
+
+    def test_github_packages_publish_step_is_target_gated(self):
+        publish = step_block("Publish to GitHub Packages")
+
+        self.assertIn("inputs.publish_target == 'github_packages'", publish)
+        self.assertIn("inputs.publish_target == 'all'", publish)
+        self.assertIn("-PpublishTarget=github_packages", publish)
+        self.assertIn("-PgithubPackagesRepository=${GITHUB_PACKAGES_REPOSITORY}", publish)
+        self.assertIn("-PgithubPackagesUrl=${GITHUB_PACKAGES_URL}", publish)
+        self.assertIn("-PpublishVersion=${EFFECTIVE_PUBLISH_VERSION}", publish)
+
+    def test_release_publish_can_sync_readme(self):
+        sync = step_block("Sync README for release")
+        commit = step_block("Commit README sync")
+
+        self.assertIn("inputs.sync_readme", sync)
+        self.assertIn("inputs.publish_mode == 'release'", sync)
+        self.assertIn("inputs.version != ''", sync)
+        self.assertIn("README_GITHUB_PACKAGES_URL", sync)
+        self.assertIn("maven.pkg.github.com", sync)
+        self.assertIn("cn.entertech.android:publish:{version}", sync)
+        self.assertIn("buildscript", sync)
+        self.assertIn("mavenCentral", sync)
+        self.assertIn("mavenLocal", sync)
+        self.assertIn("git commit -m \"[codex] Sync README publish config to ${EFFECTIVE_PUBLISH_VERSION} [skip ci]\"", commit)
+        self.assertIn("git push", commit)
+
+    def test_central_publish_step_is_target_gated(self):
+        publish = step_block("Publish to Central Portal")
+
+        self.assertIn("inputs.publish_target == 'central'", publish)
+        self.assertIn("inputs.publish_target == 'all'", publish)
+        self.assertIn("-PpublishTarget=central", publish)
+        self.assertIn("-PcentralReleaseType=${CENTRAL_RELEASE_TYPE}", publish)
+        self.assertIn("-PcentralNamespace=${CENTRAL_NAMESPACE}", publish)
+        self.assertIn("-PcentralPublishingType=${CENTRAL_PUBLISHING_TYPE}", publish)
+        self.assertIn("-PpublishVersion=${EFFECTIVE_PUBLISH_VERSION}", publish)
+
+    def test_central_secrets_are_conditionally_required(self):
+        text = workflow_text()
+        validation = step_block("Validate publish inputs")
+
+        self.assertIn("MAVEN_CENTRAL_USERNAME:\n        required: false", text)
+        self.assertIn("GPG_KEY_CONTENTS:\n        required: false", text)
+        self.assertIn("PUBLISH_TARGET\" == \"central\"", validation)
+        self.assertIn("PUBLISH_TARGET\" == \"all\"", validation)
+        self.assertIn("CENTRAL_USERNAME", validation)
+        self.assertIn("SIGNING_PASSWORD", validation)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/scripts/sync_readme_publish_version.py b/.github/scripts/sync_readme_publish_version.py
@@ -6,6 +6,10 @@
 
 SEMVER_RE = re.compile(r"^\d+\.\d+\.\d+$")
 BUILD_VERSION_RE = re.compile(r"(?m)^\s*version\s*=\s*['\"]([^'\"]+)['\"]")
+PLUGIN_REPOSITORY_BLOCK_RE = re.compile(
+    r"(?ms)(buildscript\s*\{\s*repositories\s*\{\n)(?P<body>.*?)(\n\s*\}\s*\n\s*\n\s*dependencies\s*\{\s*classpath\(\"cn\.entertech\.android:publish:)"
+)
+PUBLISH_CLASSPATH_RE = re.compile(r'classpath\("cn\.entertech\.android:publish:[^"]+"\)')
 
 
 def read_plugin_version(build_file: Path) -> str:
@@ -16,7 +20,61 @@ def read_plugin_version(build_file: Path) -> str:
     return match.group(1)
 
 
-def sync_readme_publish_version(content: str, version: str) -> str:
+def github_packages_url_from_repository(repository: str) -> str:
+    if not re.fullmatch(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+", repository):
+        raise ValueError("GitHub Packages repository must use owner/repo format")
+    return f"https://maven.pkg.github.com/{repository}"
+
+
+def normalize_publish_target(publish_target: str) -> str:
+    normalized = (publish_target or "central").strip().lower().replace("-", "_")
+    if normalized == "githubpackages":
+        normalized = "github_packages"
+    if normalized not in {"central", "github_packages", "all"}:
+        raise ValueError("publish_target must be central, github_packages, or all")
+    return normalized
+
+
+def sync_readme_code_repository(content: str, publish_target: str, github_packages_url: str = "") -> str:
+    normalized_target = normalize_publish_target(publish_target)
+    if normalized_target == "central":
+        repository_lines = [
+            "        google()",
+            "        mavenCentral()",
+            "        mavenLocal()",
+        ]
+    else:
+        if not github_packages_url:
+            raise ValueError("github_packages_url is required when publish_target includes github_packages")
+        repository_lines = [
+            "        google()",
+            "        mavenLocal()",
+            "        maven {",
+            f"            url = uri(\"{github_packages_url}\")",
+            "            credentials {",
+            "                username = providers.gradleProperty(\"gpr.user\").orNull",
+            "                    ?: System.getenv(\"GITHUB_ACTOR\")",
+            "                password = providers.gradleProperty(\"gpr.key\").orNull",
+            "                    ?: System.getenv(\"GITHUB_TOKEN\")",
+            "            }",
+            "        }",
+        ]
+
+    def replace(match: re.Match) -> str:
+        return match.group(1) + "\n".join(repository_lines) + match.group(3)
+
+    updated, count = PLUGIN_REPOSITORY_BLOCK_RE.subn(replace, content, count=1)
+    if count != 1:
+        raise ValueError("Cannot find README code configuration buildscript repository block")
+    return updated
+
+
+def sync_readme_publish_version(
+    content: str,
+    version: str,
+    publish_target: str = "central",
+    github_packages_url: str = "",
+) -> str:
     if not SEMVER_RE.fullmatch(version):
         raise ValueError(f"Publish plugin version '{version}' must use digits.digits.digits format")
 
@@ -42,33 +100,70 @@ def sync_readme_publish_version(content: str, version: str) -> str:
     next_content = content
     for pattern, replacement in replacements:
         next_content = re.sub(pattern, replacement, next_content)
+    next_content = sync_readme_code_repository(next_content, publish_target, github_packages_url)
     return next_content
 
 
+def sync_root_build_publish_version(content: str, version: str) -> str:
+    if not SEMVER_RE.fullmatch(version):
+        raise ValueError(f"Publish plugin version '{version}' must use digits.digits.digits format")
+
+    updated, count = PUBLISH_CLASSPATH_RE.subn(
+        f'classpath("cn.entertech.android:publish:{version}")',
+        content,
+        count=1,
+    )
+    if count != 1:
+        raise ValueError("Cannot find root build publish plugin classpath")
+    return updated
+
+
 def main() -> None:
     parser = argparse.ArgumentParser(description="Synchronize README publish plugin version.")
     parser.add_argument("--readme", default="README.md")
     parser.add_argument("--build-file", default="plugin_base/build.gradle.kts")
+    parser.add_argument("--root-build-file", default="")
     parser.add_argument("--version")
+    parser.add_argument("--publish-target", default="central", choices=("central", "github_packages", "all"))
+    parser.add_argument("--github-packages-repository", default="")
+    parser.add_argument("--github-packages-url", default="")
     parser.add_argument("--check", action="store_true")
     args = parser.parse_args()
 
     readme_path = Path(args.readme)
     version = args.version or read_plugin_version(Path(args.build_file))
+    github_packages_url = args.github_packages_url
+    if not github_packages_url and args.github_packages_repository:
+        github_packages_url = github_packages_url_from_repository(args.github_packages_repository)
     current = readme_path.read_text(encoding="utf-8")
-    updated = sync_readme_publish_version(current, version)
+    updated = sync_readme_publish_version(
+        current,
+        version,
+        publish_target=args.publish_target,
+        github_packages_url=github_packages_url,
+    )
 
     if args.check:
         if updated != current:
-            raise SystemExit(f"{readme_path} publish plugin version is not synchronized to {version}")
-        print(f"{readme_path} publish plugin version is synchronized to {version}")
+            raise SystemExit(f"{readme_path} publish plugin docs are not synchronized to {version}")
+        print(f"{readme_path} publish plugin docs are synchronized to {version}")
         return
 
     if updated != current:
         readme_path.write_text(updated, encoding="utf-8")
-        print(f"Updated {readme_path} publish plugin version to {version}")
+        print(f"Updated {readme_path} publish plugin docs to {version}")
     else:
-        print(f"{readme_path} publish plugin version already {version}")
+        print(f"{readme_path} publish plugin docs already {version}")
+
+    if args.root_build_file:
+        root_build_path = Path(args.root_build_file)
+        root_current = root_build_path.read_text(encoding="utf-8")
+        root_updated = sync_root_build_publish_version(root_current, version)
+        if root_updated != root_current:
+            root_build_path.write_text(root_updated, encoding="utf-8")
+            print(f"Updated {root_build_path} publish plugin classpath to {version}")
+        else:
+            print(f"{root_build_path} publish plugin classpath already {version}")
 
 
 if __name__ == "__main__":

diff --git a/.github/scripts/sync_readme_publish_version_test.py b/.github/scripts/sync_readme_publish_version_test.py
@@ -1,12 +1,30 @@
 import unittest
 
-from sync_readme_publish_version import sync_readme_publish_version
+from sync_readme_publish_version import (
+    github_packages_url_from_repository,
+    sync_readme_publish_version,
+    sync_root_build_publish_version,
+)
+
+
+README_CODE_CONFIG = """
+buildscript {
+    repositories {
+        google()
+        mavenCentral()
+        mavenLocal()
+    }
+
+    dependencies {
+        classpath("cn.entertech.android:publish:1.2.0")
+    }
+}
+"""
 
 
 class SyncReadmePublishVersionTest(unittest.TestCase):
     def test_updates_publish_plugin_versions_only(self):
-        readme = """
-classpath("cn.entertech.android:publish:1.2.0")
+        readme = README_CODE_CONFIG + """
 cn.entertech.android:publish:<version>
 cn.entertech.publish:cn.entertech.publish.gradle.plugin:<version>
 id("cn.entertech.publish") version "<version>"
@@ -23,9 +41,69 @@ def test_updates_publish_plugin_versions_only(self):
         self.assertIn('id("cn.entertech.publish") version "1.2.3"', result)
         self.assertIn('version = "1.0.0"', result)
 
+    def test_keeps_maven_central_code_config_for_central_publish(self):
+        result = sync_readme_publish_version(README_CODE_CONFIG, "1.2.3", publish_target="central")
+
+        self.assertIn("        mavenCentral()", result)
+        self.assertNotIn("maven.pkg.github.com", result)
+
+    def test_updates_code_config_for_github_packages_publish(self):
+        result = sync_readme_publish_version(
+            README_CODE_CONFIG,
+            "1.2.3",
+            publish_target="github_packages",
+            github_packages_url="https://maven.pkg.github.com/owner/repo",
+        )
+
+        self.assertNotIn("        mavenCentral()", result)
+        self.assertIn('url = uri("https://maven.pkg.github.com/owner/repo")', result)
+        self.assertIn('username = providers.gradleProperty("gpr.user").orNull', result)
+        self.assertIn('password = providers.gradleProperty("gpr.key").orNull', result)
+        self.assertIn('classpath("cn.entertech.android:publish:1.2.3")', result)
+
+    def test_updates_code_config_for_all_publish(self):
+        result = sync_readme_publish_version(
+            README_CODE_CONFIG,
+            "1.2.3",
+            publish_target="all",
+            github_packages_url="https://maven.pkg.github.com/owner/repo",
+        )
+
+        self.assertNotIn("        mavenCentral()", result)
+        self.assertIn('url = uri("https://maven.pkg.github.com/owner/repo")', result)
+
+    def test_requires_github_packages_url_when_target_includes_github_packages(self):
+        with self.assertRaisesRegex(ValueError, "github_packages_url is required"):
+            sync_readme_publish_version(README_CODE_CONFIG, "1.2.3", publish_target="github_packages")
+
+    def test_builds_github_packages_url_from_repository(self):
+        self.assertEqual(
+            "https://maven.pkg.github.com/owner/repo",
+            github_packages_url_from_repository("owner/repo"),
+        )
+
     def test_rejects_non_semver(self):
         with self.assertRaisesRegex(ValueError, "digits.digits.digits"):
-            sync_readme_publish_version("README", "1.2.3-rc1")
+            sync_readme_publish_version(README_CODE_CONFIG, "1.2.3-rc1")
+
+    def test_updates_root_build_publish_plugin_classpath(self):
+        build_file = """
+buildscript {
+    dependencies {
+        classpath("com.android.tools.build:gradle:8.1.3")
+        classpath("cn.entertech.android:publish:1.2.1")
+    }
+}
+"""
+
+        result = sync_root_build_publish_version(build_file, "1.2.3")
+
+        self.assertIn('classpath("cn.entertech.android:publish:1.2.3")', result)
+        self.assertIn('classpath("com.android.tools.build:gradle:8.1.3")', result)
+
+    def test_rejects_missing_root_build_publish_plugin_classpath(self):
+        with self.assertRaisesRegex(ValueError, "Cannot find root build publish plugin classpath"):
+            sync_root_build_publish_version("buildscript {}\n", "1.2.3")
 
 
 if __name__ == "__main__":