ci(release): Publish GitHub Release on version tag

Author: jeffjensen

.github/workflows/release.yml

@@ -41,3 +41,24 @@ jobs:
           CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
         run: ${{ env.MAVEN_COMMAND }} ${{ env.MAVEN_CLI_COMMON }} deploy -Prelease -DskipTests -Darchetype.test.skip=true
+
+  # Publish a GitHub Release for the tag once the Central deploy succeeds. Notes are
+  # auto-generated by the GitHub Release Notes API from merged PRs/commits since the
+  # previous tag. Isolated from the deploy job so contents:write is not granted while
+  # GPG keys and Central credentials are in scope.
+  github-release:
+    needs: release
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write # required to create the GitHub Release
+    steps:
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >
+          gh release create "${{ github.ref_name }}"
+          --repo "${{ github.repository }}"
+          --title "${{ github.ref_name }}"
+          --generate-notes
+          --verify-tag