ci: migrate publishing to Sonatype Central Portal (PER-9567)

[Shivanshu-07]

Why

The release Publish workflow has been failing at the very first publish task (run):

> Task :initializeSonatypeStagingRepository FAILED
> Failed to create staging repository, server at
  https://oss.sonatype.org/service/local/ responded with status code 402, body:

The build itself is fine — assembleRelease and androidSourcesJar succeed. The failure is the publish step: scripts/publish-root.gradle uses io.github.gradle-nexus.publish-plugin pointed at the legacy OSSRH endpoint https://oss.sonatype.org/service/local/. Sonatype decommissioned legacy OSSRH (EOL 30 Jun 2025); the old Nexus no longer creates staging repositories, and the empty-body HTTP 402 is its shut-down signature. This is not a credentials/transient issue — every release will fail here until publishing moves to the Central Portal. The gradle-nexus.publish-plugin only speaks the old Nexus API and cannot target the Portal.

This blocks the v1.0.5-beta.0 release.

What

Migrate publishing to the Sonatype Central Portal via com.vanniktech.maven.publish (0.30.0), the de-facto standard for Android libraries with first-class Portal support:

• build.gradle — replace the nexus plugin with com.vanniktech.maven.publish; drop apply from: scripts/publish-root.gradle.
• espresso/build.gradle — apply the plugin and configure mavenPublishing { … }: coordinates io.percy:espresso-java:1.0.5-beta.0, release AAR + sources + javadoc jars, publishToMavenCentral(true) (Central Portal default + auto-release), signAllPublications(), and the POM ported verbatim from the old script.
• Removed scripts/publish-root.gradle and scripts/publish-module.gradle (fully superseded).
• .github/workflows/publish.yml — single ./gradlew publishToMavenCentral step using ORG_GRADLE_PROJECT_mavenCentral* / ORG_GRADLE_PROJECT_signingInMemory* env vars; auto-release replaces the old closeAndReleaseSonatypeStagingRepository. Bumped actions/checkout/setup-java to v4 to clear Node 20 warnings.

The artifact coordinates, POM metadata, and signing are preserved exactly; the published io.percy:espresso-java artifact is unchanged.

⚠️ Required before this can publish (external, one-time)

This needs a Percy Sonatype Central Portal owner for the io.percy namespace to:

1. Confirm the io.percy namespace is migrated/registered on central.sonatype.com.
2. Generate a user token and update the repo secrets OSSRH_USERNAME / OSSRH_PASSWORD to the token values (the SIGNING_KEY* secrets stay as-is). SONATYPE_STAGING_PROFILE_ID is no longer used.

Once the token is in place, re-run the Publish workflow (or re-cut the v1.0.5-beta.0 release) to verify end-to-end.

Testing notes

Gradle config could not be executed locally (no Android SDK + JDK 11 on hand); the DSL was validated against the plugin's current docs. CI exercises the real publish path once the Portal token above is provisioned.

🤖 Generated with Claude Code