Merge CI + Deployment into one gated workflow

.github/workflows/main.yml

@@ -1,14 +1,14 @@
 name: LogMob CI
 
 on:
+  pull_request:
   push:
     branches:
       - develop
-      - 'submodule/CCC'
-  pull_request:
+      - master
 
 jobs:
-  build:
+  ci:
 
     runs-on: macos-26
 
@@ -19,6 +19,31 @@ jobs:
       - name: Gradle Build
         run: ./gradlew build
 
+      # Publish only on a merge to develop/master, and only after the build above passes.
+      # develop -> X.Y-SNAPSHOT (unsigned), master -> X.Y.Z release (signed).
+      - name: Publish
+        if: github.event_name == 'push'
+        # Normalize the armored GPG key: literal "\n" -> real newlines (vanniktech's
+        # signingInMemoryKey needs real newlines); a correct key passes through unchanged.
+        run: |
+          export ORG_GRADLE_PROJECT_signingInMemoryKey="$(printf '%b' "$GPG_KEY_RAW")"
+          ./gradlew publishToMavenCentral --no-configuration-cache
+        env:
+          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_USERNAME }}
+          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_PASSWORD }}
+          GPG_KEY_RAW: ${{ secrets.GPG_KEY }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_PASSWORD }}
+
+      - name: Notify slack success
+        if: success() && github.event_name == 'push'
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        uses: voxmedia/github-action-slack-notify-build@v2
+        with:
+          channel: submob
+          status: SUCCESS
+          color: good
+
       - name: Notify slack fail
         if: failure()
         env:
@@ -27,4 +52,4 @@ jobs:
         with:
           channel: submob
           status: FAILED
-          color: danger
+          color: danger

logmob/logmob.gradle.kts

@@ -43,6 +43,9 @@ kotlin {
 
 mavenPublishing {
     // Coordinates (GROUP + POM_ARTIFACT_ID), POM, host and auto-release come from gradle.properties.
-    // Central Portal requires signed artifacts; keys are provided in CI via ORG_GRADLE_PROJECT_* env.
-    signAllPublications()
+    // Sign releases only — Central Portal snapshots aren't signed, and the signing key is provided
+    // to release CI via ORG_GRADLE_PROJECT_* env.
+    if (!version.toString().endsWith("SNAPSHOT")) {
+        signAllPublications()
+    }
 }