Refactor GitHub release workflow to attach signed artifacts (#160)

* ci: reorder release pipeline — sign first, then publish to GitHub

Fixes OpenSSF Scorecard "Signed-Releases" finding: release artifacts
uploaded to GitHub were unsigned. The pipeline now publishes to Maven
Central first (GPG-signed via maven-gpg-plugin), collects the signed
JARs and .asc files from target/, then attaches them to the GitHub
Release so every release asset has a verifiable signature.

For java-llama.cpp the release_to_maven_central flag is preserved:
- When true: publish-release signs + deploys to Central, then
  github-release-signed uploads the signed assets to GitHub.
- When false/absent: github-release uploads unsigned jars as before.

* ci: remove unsigned github-release fallback from java-llama.cpp

A GitHub Release is now only created via the signed path:
publish-release (GPG sign + Maven Central) -> github-release-signed.
The unsigned fallback job is removed for a clean, single-path pipeline.

Author: bernardladenthin

.github/workflows/publish.yml

@@ -739,29 +739,14 @@ jobs:
           MAVEN_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN }}
 
-  github-release:
-    name: Attach Binaries to GitHub Release
-    needs: [check-tag]
-    if: needs.check-tag.result == 'success'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          name: llama-jars
-          path: release-assets/
-      - name: Upload release assets
-        uses: softprops/action-gh-release@v3
-        with:
-          files: release-assets/*
-
   publish-release:
     name: Publish Release to Central
     if: needs.check-tag.result == 'success' && github.event.inputs.release_to_maven_central == 'true'
-    needs: [github-release, check-tag, crosscompile-linux-x86_64-cuda]
+    needs: [check-tag, crosscompile-linux-x86_64-cuda]
     runs-on: ubuntu-latest
     environment: maven-central
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v6
       - uses: actions/download-artifact@v8
@@ -790,3 +775,29 @@ jobs:
           MAVEN_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      - name: Collect signed artifacts
+        run: |
+          mkdir -p signed-release-assets
+          cp target/*.jar signed-release-assets/ 2>/dev/null || true
+          cp target/*.jar.asc signed-release-assets/ 2>/dev/null || true
+      - uses: actions/upload-artifact@v7
+        with:
+          name: signed-release-assets
+          path: signed-release-assets/
+
+  github-release-signed:
+    name: Attach Signed Binaries to GitHub Release
+    needs: [publish-release]
+    if: needs.publish-release.result == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: signed-release-assets
+          path: release-assets/
+      - name: Upload release assets
+        uses: softprops/action-gh-release@v3
+        with:
+          files: release-assets/*