ci: automate Maven Central publishing with GitHub Actions

[kewynakshlley]

No description provided.

[cubic-dev-ai]

1 issue found across 4 files

Confidence score: 4/5

• This PR is likely safe to merge, with minimal risk: the reported issue is moderate-low severity (4/10) and appears confined to CI workflow hygiene rather than runtime product behavior.
• The main concern is in .github/workflows/release.yml: the Decode GPG key step is dead code and writes a secret to disk unnecessarily, which increases secret-handling exposure even though signing uses in-memory keys.
• Pay close attention to .github/workflows/release.yml - remove or align the GPG decode step to avoid unnecessary secret material being written to disk.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/release.yml">

<violation number="1" location=".github/workflows/release.yml:23">
P2: The `Decode GPG key` step is dead code and unnecessarily writes the secret to disk even though signing uses `useInMemoryPgpKeys` from environment variables. Remove this step (or update Gradle to consume the file) to avoid needless secret exposure.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}