Publish to Maven Central when a tag is pushed

.github/workflows/maven.yml

@@ -6,6 +6,7 @@ name: Java CI with Maven
 on:
   push:
     branches: [master]
+    tags: ["**"]
   pull_request:
     branches: [master]
 
@@ -26,6 +27,21 @@ jobs:
           distribution: "adopt"
       - name: Build with Maven
         run: mvn test -B
+      - name: Import signing key
+        if: ${{ github.ref_type == 'tag' }}
+        env:
+          SIGNING_KEY: ${{ secrets.ARTIFACT_SIGNING_PRIVATE_KEY }}
+        run: |
+          echo "-----BEGIN PGP PUBLIC KEY BLOCK-----" > key.txt
+          echo "$SIGNING_KEY" >> key.txt
+          echo "-----END PGP PUBLIC KEY BLOCK-----" >> key.txt
+          gpg --import key.txt
+      - name: Release to Maven Central
+        if: ${{ github.ref_type == 'tag' }}
+        env:
+          SONATYPE_NEXUS_USERNAME: ${{ secrets.SONATYPE_NEXUS_USERNAME }}
+          SONATYPE_NEXUS_PASSWORD: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
+        run: mvn package gpg:sign deploy --batch-mode --settings .maven_settings.xml
 
   labeler:
     needs: build

.maven_settings.xml

@@ -0,0 +1,10 @@
+<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
+    <servers>
+        <server>
+            <id>ossrh</id>
+            <username>${env.SONATYPE_NEXUS_USERNAME}</username>
+            <password>${env.SONATYPE_NEXUS_PASSWORD}</password>
+        </server>
+    </servers>
+</settings>