diff --git a/.circleci/config.yml b/.circleci/config.yml
index 7881f2d2d3..b9f91766c9 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -140,52 +140,6 @@ jobs:
           path: lib-extra/build/test-results/test
       - store_test_results:
           path: plugin-gradle/build/test-results/test
-  do_release_all:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :changelogPush
-          command: ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all
-      - run:
-          name: gradlew :plugin-gradle:changelogPush
-          command: ./gradlew :plugin-gradle:changelogPush -Prelease=true -Pgradle.publish.key=${gradle_key} -Pgradle.publish.secret=${gradle_secret} --stacktrace --warning-mode all
-      - run:
-          name: gradlew :plugin-maven:changelogPush
-          command: ./gradlew :plugin-maven:changelogPush -Prelease=true --stacktrace --warning-mode all
-  do_release_lib:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :changelogPush
-          command: ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all
-  do_release_plugin_gradle:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :plugin-gradle:changelogPush
-          command: ./gradlew :plugin-gradle:changelogPush -Prelease=true -Pgradle.publish.key=${gradle_key} -Pgradle.publish.secret=${gradle_secret} --stacktrace
-  do_release_plugin_maven:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :plugin-maven:changelogPush
-          command: ./gradlew :plugin-maven:changelogPush -Prelease=true --stacktrace
 
 workflows:
   version: 2
@@ -205,25 +159,3 @@ workflows:
       - test_npm_8:
           requires:
             - assemble_testClasses
-  deploy:
-    jobs:
-      - release_all:
-          type: approval
-      - do_release_all:
-          requires:
-            - release_all
-      - release_plugin_gradle:
-          type: approval
-      - do_release_plugin_gradle:
-          requires:
-            - release_plugin_gradle
-      - release_plugin_maven:
-          type: approval
-      - do_release_plugin_maven:
-          requires:
-            - release_plugin_maven
-      - release_lib:
-          type: approval
-      - do_release_lib:
-          requires:
-            - release_lib
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000000..6af73db448
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,63 @@
+# GH_TOKEN
+# NEXUS_USER
+# NEXUS_PASS
+# GPG_PASSPHRASE
+# GPG_KEY (base64)
+#   gpg --export-secret-keys --armor KEY_ID | openssl base64 | pbcopy
+# GRADLE_PORTAL_KEY
+# GRADLE_PORTAL_SECRET
+
+name: deploy
+on:
+  workflow_dispatch:
+    inputs:
+      to_publish:
+        description: 'What to publish'
+        required: true
+        default: 'all'
+        type: choice
+        options:
+          - plugin-gradle
+          - plugin-maven
+          - all
+          - lib
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    name: deploy
+    env:
+      gh_token: ${{ secrets.GH_TOKEN }}
+      ORG_GRADLE_PROJECT_nexus_user: ${{ secrets.NEXUS_USER }}
+      ORG_GRADLE_PROJECT_nexus_pass: ${{ secrets.NEXUS_PASS }}
+      ORG_GRADLE_PROJECT_gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
+      ORG_GRADLE_PROJECT_gpg_key64: ${{ secrets.GPG_KEY }}
+
+        gradle_key
+    steps:
+      - uses: actions/checkout@v3
+      - name: jdk 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: 11
+          distribution: 'temurin'
+      - name: gradle caching
+        uses: gradle/gradle-build-action@v2
+      - name: publish all
+        if: "${{ github.event.inputs.to_publish == 'all' }}"
+        run: |
+          ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all
+          ./gradlew :plugin-gradle:changelogPush -Prelease=true -Pgradle.publish.key=${{ secrets.GRADLE_PORTAL_KEY }} -Pgradle.publish.secret=${{ secrets.GRADLE_PORTAL_SECRET }} --stacktrace --warning-mode all
+          ./gradlew :plugin-maven:changelogPush -Prelease=true --stacktrace --warning-mode all
+      - name: publish just plugin-gradle
+        if: "${{ github.event.inputs.to_publish == 'plugin-gradle' }}"
+        run: |
+          ./gradlew :plugin-gradle:changelogPush -Prelease=true -Pgradle.publish.key=${{ secrets.GRADLE_PORTAL_KEY }} -Pgradle.publish.secret=${{ secrets.GRADLE_PORTAL_SECRET }} --stacktrace --warning-mode all
+      - name: publish just plugin-maven
+        if: "${{ github.event.inputs.to_publish == 'plugin-maven' }}"
+        run: |
+          ./gradlew :plugin-maven:changelogPush -Prelease=true --stacktrace --warning-mode all
+      - name: publish just lib
+        if: "${{ github.event.inputs.to_publish == 'lib' }}"
+        run: |
+          ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all