build: Only sign when making official releases

This implies not to sign JitPack snapshot builds, which would not work as
signing is not set up there.

Signed-off-by: Sebastian Schuberth <[email protected]>

.github/workflows/release.yml

@@ -40,6 +40,7 @@ jobs:
         env:
           ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.OSSRH_USERNAME }}
           ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.OSSRH_PASSWORD }}
+          ORG_GRADLE_PROJECT_RELEASE_SIGNING_ENABLED: true
           ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
           ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
         run: ./gradlew publishAndReleaseToMavenCentral

buildSrc/src/main/kotlin/ort-publication-conventions.gradle.kts

@@ -30,7 +30,6 @@ mavenPublishing {
 
     coordinates(groupId = "org${getGroupId(parent)}")
     publishToMavenCentral(SonatypeHost.DEFAULT)
-    signAllPublications()
 
     pom {
         name = project.name