We had an issue once to give all other ee4j members read access for other CIs for the ee4j projects, but seemingly that is some manual thing then that must be periodically updated.
#!/bin/bash -ex
if [ ${DROP_FIRST} = 'true' ] || [ ${LIST_FIRST} = 'true' ]; then
   exit 0
fi
MVN_HOME="/opt/tools/apache-maven/latest"
JAVA_HOME="/opt/tools/java/openjdk/jdk-11/latest"
PATH="${MVN_HOME}/bin:${JAVA_HOME}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# Maven plugins
VERSIONS_PLUGIN='org.codehaus.mojo:versions-maven-plugin:2.5'
HELP_PLUGIN='org.apache.maven.plugins:maven-help-plugin:2.1.1'
MVN_EXTRA='--batch-mode -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn'
MAVEN_SKIP_RC=1
# Directory with project top level pom.xml
BUILD_DIR="${WORKSPACE}/api"
cd ${BUILD_DIR}
# Check whether top level pom.xml contains SNAPSHOT version
if ! grep '<version>' pom.xml | grep 'RC' ; then
  echo '-[ Not an RC version ]-------------------------------------------'    
  # Check whether top level pom.xml contains SNAPSHOT version
  if ! grep '<version>' pom.xml | grep 'SNAPSHOT' ; then
    echo '-[ Missing SNAPSHOT version in POM! ]-------------------------------------------'
    exit 1
  fi  
  # Compute release versions
  SNAPSHOT_VERSION=`mvn ${MVN_EXTRA} -B ${HELP_PLUGIN}:evaluate -Dexpression=project.version 2> /dev/null | grep -E '^[0-9]+(\.[0-9]+)+-SNAPSHOT$'`  
  if [ -z "${RELEASE_VERSION}" ]; then
    if [ -z ${SNAPSHOT_VERSION} ]; then
      echo '-[ Missing required snapshot version number! ]----------------------------------'
    fi
    RELEASE_VERSION=`echo ${SNAPSHOT_VERSION} | sed -e 's/-SNAPSHOT//'`
  fi  
  # Bash specific code
  if [ -z "${NEXT_VERSION}" ]; then
    NEXT_VERSION=`echo ${RELEASE_VERSION} | sed -e 's/\([0-9][0-9]*\.[0-9][0-9]*\).*/\1/'`
    set -f
    NEXT_COMPONENTS=(${RELEASE_VERSION//\./ })
    LAST_INDEX=$((${#NEXT_COMPONENTS[@]} - 1))
    NEXT_COMPONENTS[${LAST_INDEX}]=$((${NEXT_COMPONENTS[${LAST_INDEX}]} + 1))
    NEXT_VERSION=`echo ${NEXT_COMPONENTS[@]} | tr ' ' '.'`'-SNAPSHOT'
  fi
else
  SNAPSHOT_VERSION=`mvn ${MVN_EXTRA} -B ${HELP_PLUGIN}:evaluate -Dexpression=project.version 2> /dev/null | grep -E '^[0-9]+(\.[0-9]+)+-RC[0-9]+$'`
  RELEASE_VERSION=${SNAPSHOT_VERSION}
  NEXT_VERSION=${SNAPSHOT_VERSION}
fi
RELEASE_TAG="${RELEASE_VERSION}-RELEASE"
echo "Current version: ${SNAPSHOT_VERSION}"
echo "Release version: ${RELEASE_VERSION}"
echo "Next version:    ${NEXT_VERSION}"
echo "Release tag:     ${RELEASE_TAG}"
if [ -z "${SNAPSHOT_VERSION}" -o -z "${RELEASE_VERSION}" -o -z "${NEXT_VERSION}" ]; then
  echo '-[ Missing required version numbers! ]------------------------------------------'
  exit 1
fi
if [ ${DRY_RUN} = 'true' ]; then
  echo '-[ Dry run turned on ]----------------------------------------------------------'
  MVN_DEPLOY_ARGS=''
  echo '-[ Skipping GitHub branch and tag checks ]--------------------------------------'
else
  # MVN_DEPLOY_ARGS='deploy:deploy'
  MVN_DEPLOY_ARGS='nexus-staging:deploy'
  GIT_ORIGIN=`git remote`  
  echo '-[ Prepare branch ]-------------------------------------------------------------'
  if [[ -n `git branch -r | grep "${GIT_ORIGIN}/${RELEASE_VERSION}"` ]]; then
    if [ "${OVERWRITE}" = 'true' ]; then
      echo "${GIT_ORIGIN}/${RELEASE_VERSION} branch already exists, deleting"
      git push --delete origin "${RELEASE_VERSION}" && true
    else
      echo "Error: ${GIT_ORIGIN}/${RELEASE_VERSION} branch already exists"
      exit 1
    fi
  fi  
  echo '-[ Release tag cleanup ]--------------------------------------------------------'
  if [[ -n `git ls-remote --tags ${GIT_ORIGIN} | grep "${RELEASE_TAG}"` ]]; then
    if [ "${OVERWRITE}" = 'true' ]; then
      echo "${RELEASE_TAG} tag already exists, deleting"
      git push --delete origin "${RELEASE_TAG}" && true
    else
      echo "Error: ${RELEASE_TAG} tag already exists"
      exit 1
    fi
  fi
fi
cd ${WORKSPACE}
# Always delete local branch if exists
git branch --delete "${RELEASE_VERSION}" && true
git checkout -b ${RELEASE_VERSION}
# Always delete local tag if exists
git tag --delete "${RELEASE_TAG}" && true
cd ${BUILD_DIR}
# Project identifiers
ARTIFACT_ID=$(mvn ${MVN_EXTRA} -B ${HELP_PLUGIN}:evaluate -Dexpression=project.artifactId | grep -Ev '(^\[)')
GROUP_ID=$(mvn ${MVN_EXTRA} -B ${HELP_PLUGIN}:evaluate -Dexpression=project.groupId | grep -Ev '(^\[)')
if [ ${SNAPSHOT_VERSION} != ${RELEASE_VERSION} ]; then
  echo '-[ Set release version ]--------------------------------------------------------'  
  # Set release version
  mvn -U -C \
      -DnewVersion="${RELEASE_VERSION}" \
      -DgenerateBackupPoms=false \
      clean ${VERSIONS_PLUGIN}:set ${MVN_EXTRA}  
  cd ${WORKSPACE}  
  echo '-[ Commit modified pom.xml files ]----------------------------------------------'
  POM_FILES=`git status | grep -E 'modified:.*pom\.xml' | sed -e 's/[[:space:]][[:space:]]*modified:[[:space:]][[:space:]]*//'`
  git add ${POM_FILES} && \
  git commit -m "Prepare release ${GROUP_ID}:${ARTIFACT_ID}:${RELEASE_VERSION}"
fi
echo '-[ Deploy artifacts to staging repository ]-------------------------------------'
cd ${BUILD_DIR}
mvn -U -C -s /home/jenkins/.m2/settings.xml \
    -DskipTests -Ddoclint=none -Poss-release \
    clean package \
    gpg:sign install:install \
    ${MVN_DEPLOY_ARGS} ${MVN_EXTRA}    
# Typical output of this step:
#  * Remote staging into staging profile ID "6f25e242715ce0"
#  * Created staging repository with ID "jakartasecurityauthmessage-1003".
#  * Staging repository at 
https://oss.sonatype.org:443/service/local/staging/deployByRepositoryId/jakartasecurityauthmessage-1003#  * Uploading locally staged artifacts to profile jakarta.security.auth.message
#  * Upload of locally staged artifacts finished.
#  * Closing staging repository with ID "jakartasecurityauthmessage-1003".
echo '-[ Tag release ]----------------------------------------------------------------'
cd ${WORKSPACE}
git tag "${RELEASE_TAG}" -m "Release ${GROUP_ID}:${ARTIFACT_ID}:${RELEASE_VERSION}"
cd ${BUILD_DIR}
if [ ${SNAPSHOT_VERSION} != ${NEXT_VERSION} ]; then
  echo '-[ Set next snapshot version ]--------------------------------------------------'
  mvn -U -C \
      -DnewVersion="${NEXT_VERSION}" \
      -DgenerateBackupPoms=false \
      clean ${VERSIONS_PLUGIN}:set ${MVN_EXTRA}  
  cd ${WORKSPACE}  
  echo '-[ Commit modified pom.xml files ]----------------------------------------------'
  POM_FILES=`git status | grep -E 'modified:.*pom\.xml' | sed -e 's/[[:space:]][[:space:]]*modified:[[:space:]][[:space:]]*//'`
  git add ${POM_FILES} && \
  git commit -m "Prepare next development cycle for ${NEXT_VERSION}"
fi
GIT_STATUS=`git status`
echo $GIT_STATUS
if [ ${DRY_RUN} = 'true' ]; then
  echo '-[ Skipping GitHub update ]-----------------------------------------------------'
else
  echo '-[ Push branch and tag to GitHub ]----------------------------------------------'
  git push origin "${RELEASE_VERSION}"
  git push origin "${RELEASE_TAG}"
fi