diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 20a419ceb5..8535c492ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,7 @@
 name: Continuous Integration
 
 on:
+  workflow_call:
   push:
     branches:
       - master
@@ -10,7 +11,7 @@ on:
       - master
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 env:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2926e37390..f1ede3ac02 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,6 +1,7 @@
 name: "CodeQL"
 
 on:
+  workflow_call:
   push:
     branches:
       - master
@@ -10,7 +11,7 @@ on:
       - master
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000000..acb9704090
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,59 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - '*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  GRADLE_OPTS: '-Dorg.gradle.daemon=false -Dorg.gradle.java.installations.auto-detect=false -Dorg.gradle.warning.mode=fail'
+
+jobs:
+  ci:
+    uses: ./.github/workflows/ci.yml
+
+  codeql:
+    uses: ./.github/workflows/codeql.yml
+
+  release:
+    name: Release java artifacts
+    permissions:
+      contents: write
+      packages: write
+    needs: [ ci, codeql ]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref }}
+      - name: Create Release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ github.ref }}
+          release_name: Release ${{ github.ref }}
+          draft: true
+      - name: Setup java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'zulu'
+          java-version: 8
+      - name: Setup BUILD_JAVA_HOME & BUILD_JAVA_VERSION
+        run: |
+          java -Xinternalversion
+          echo "BUILD_JAVA_HOME=${JAVA_HOME}" >> $GITHUB_ENV
+          echo "BUILD_JAVA_VERSION=8" >> $GITHUB_ENV
+      - name: Publish with Gradle to Open Source
+        run: ./gradlew publishAllPublicationsToOssRepository
+        env:
+          ORG_GRADLE_PROJECT_repoUsername: ${{ secrets.ossrhUsername }}
+          ORG_GRADLE_PROJECT_repoPassword: ${{ secrets.ossrhPassword }}
+          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.signingKey }}
+          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.signingPassword }}
diff --git a/build.gradle b/build.gradle
index ae31ce38fa..f625e458ce 100644
--- a/build.gradle
+++ b/build.gradle
@@ -103,6 +103,8 @@ def projectPom = {
 ext {
     group = artioGroup
     isReleaseVersion = !version.endsWith("SNAPSHOT")
+    repoUrl = 'https://oss.sonatype.org/service/local/staging/deploy/maven2/'
+    snapshotUrl = 'https://oss.sonatype.org/content/repositories/snapshots/'
     iLink3Enabled = Boolean.getBoolean("fix.core.iLink3Enabled")
 
     if (!project.hasProperty('repoUsername')) {
@@ -113,12 +115,12 @@ ext {
         repoPassword = ''
     }
 
-    if (!project.hasProperty('repoUrl')) {
-        repoUrl = ''
+    if (!project.hasProperty('signingKey')) {
+        signingKey = null
     }
 
-    if (!project.hasProperty('snapshotUrl')) {
-        snapshotUrl = ''
+    if (!project.hasProperty('signingPassword')) {
+        signingPassword = null
     }
 }
 
@@ -288,6 +290,9 @@ subprojects {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         required { isReleaseVersion && gradle.taskGraph.hasTask("uploadArchives") }
         sign configurations.archives
     }
@@ -366,6 +371,9 @@ project(':artio-codecs') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioCodecs
     }
 }
@@ -446,6 +454,9 @@ project(':artio-ilink3-codecs') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioILink3Codecs
     }
 }
@@ -523,6 +534,9 @@ project(':artio-binary-entrypoint-codecs') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioBinaryEntrypointCodecs
     }
 }
@@ -546,6 +560,9 @@ project(':artio-binary-entrypoint-impl') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioBinaryEntrypointImpl
     }
 }
@@ -577,6 +594,9 @@ project(':artio-ilink3-impl') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioIlink3Impl
     }
 }
@@ -643,6 +663,9 @@ project(':artio-session-codecs') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioSessionCodecs
     }
 }
@@ -704,6 +727,9 @@ project(':artio-session-fixt-codecs') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioSessionFixtCodecs
     }
 }
@@ -736,6 +762,9 @@ project(':artio-core') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioCore
     }
 }
@@ -797,6 +826,9 @@ project(':artio-system-tests') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioSystemTests
     }
 }
@@ -832,6 +864,9 @@ project(':artio-ilink-system-tests') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioILink3SystemTests
     }
 }
@@ -862,6 +897,9 @@ project(':artio-binary-entrypoint-system-tests') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioBinaryEntrypointSystemTests
     }
 }
@@ -894,6 +932,9 @@ project(':artio-samples') {
     }
 
     signing {
+        if (signingKey != null) {
+            useInMemoryPgpKeys(signingKey, signingPassword)
+        }
         sign publishing.publications.artioSamples
     }
 }