diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index d5106c79a3..c01d8c2c8a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,4 +1,4 @@
-# GH_TOKEN
+# GITHUB_TOKEN
 # NEXUS_USER
 # NEXUS_PASS64 (base64 NOTE: `base64` and `openssl base64` failed, had to use Java
 #   byte[] data = "{{password}}".getBytes(StandardCharsets.UTF_8);
@@ -30,13 +30,17 @@ jobs:
     runs-on: ubuntu-latest
     name: deploy
     env:
-      gh_token: ${{ secrets.GH_TOKEN }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       ORG_GRADLE_PROJECT_nexus_user: ${{ secrets.NEXUS_USER }}
       ORG_GRADLE_PROJECT_nexus_pass64: ${{ secrets.NEXUS_PASS64 }}
       ORG_GRADLE_PROJECT_gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
       ORG_GRADLE_PROJECT_gpg_key64: ${{ secrets.GPG_KEY64 }}
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # All tags should be fetched.
       - name: jdk 11
         uses: actions/setup-java@v4
         with:
@@ -46,23 +50,69 @@ jobs:
         uses: gradle/actions/setup-gradle@v3
         with:
           gradle-home-cache-cleanup: true
-      - name: git fetch origin main
-        run: git fetch origin main
+      - name: Generate release name for lib
+        if: github.event.inputs.to_publish == 'all' || github.event.inputs.to_publish == 'lib'
+        run: |
+          # Find the latest tag in the lib/ namespace
+          export LIB_TAG=$(git tag --sort=-creatordate --list 'lib/*' | head -n 1)
+          echo "LIB_TAG=$LIB_TAG" >> $GITHUB_ENV
+          # Generate the release name looks like "Lib 1.2.3"
+          echo "LIB_NAME=Lib $(echo $LIB_TAG | cut -d'/' -f2)" >> $GITHUB_ENV
+      - name: Extract release notes for lib
+        if: github.event.inputs.to_publish == 'all' || github.event.inputs.to_publish == 'lib'
+        uses: ffurrer2/extract-release-notes@v2
+        with:
+          changelog_file: CHANGES.md
+          release_notes_file: RELEASE_NOTES_FOR_LIB.md
+      - name: Generate release name for Gradle plugin
+        if: github.event.inputs.to_publish == 'all' || github.event.inputs.to_publish == 'plugin-gradle'
+        run: |
+          # Find the latest tag in the gradle/ namespace
+          export PLUGIN_GRADLE_TAG=$(git tag --sort=-creatordate --list 'gradle/*' | head -n 1)
+          echo "PLUGIN_GRADLE_TAG=$PLUGIN_GRADLE_TAG" >> $GITHUB_ENV
+          # Generate the release name looks like "Gradle Plugin 1.2.3"
+          echo "PLUGIN_GRADLE_NAME=Gradle Plugin $(echo $PLUGIN_GRADLE_TAG | cut -d'/' -f2)" >> $GITHUB_ENV
+      - name: Extract release notes for Gradle plugin
+        if: github.event.inputs.to_publish == 'all' || github.event.inputs.to_publish == 'plugin-gradle'
+        uses: ffurrer2/extract-release-notes@v2
+        with:
+          changelog_file: plugin-gradle/CHANGES.md
+          release_notes_file: RELEASE_NOTES_FOR_PLUGIN_GRADLE.md
+      - name: Generate release name for Maven plugin
+        if: github.event.inputs.to_publish == 'all' || github.event.inputs.to_publish == 'plugin-maven'
+        run: |
+          # Find the latest tag in the maven/ namespace
+          export PLUGIN_MAVEN_TAG=$(git tag --sort=-creatordate --list 'maven/*' | head -n 1)
+          echo "PLUGIN_MAVEN_TAG=$PLUGIN_MAVEN_TAG" >> $GITHUB_ENV
+          # Generate the release name looks like "Maven Plugin 1.2.3"
+          echo "PLUGIN_MAVEN_NAME=Maven Plugin $(echo $PLUGIN_MAVEN_TAG | cut -d'/' -f2)" >> $GITHUB_ENV
+      - name: Extract release notes for Maven plugin
+        if: github.event.inputs.to_publish == 'all' || github.event.inputs.to_publish == 'plugin-maven'
+        uses: ffurrer2/extract-release-notes@v2
+        with:
+          changelog_file: plugin-maven/CHANGES.md
+          release_notes_file: RELEASE_NOTES_FOR_PLUGIN_MAVEN.md
       - name: publish all
         if: "${{ github.event.inputs.to_publish == 'all' }}"
         run: |
           ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all --no-configuration-cache
           ./gradlew :plugin-gradle:changelogPush -Prelease=true -Pgradle.publish.key=${{ secrets.GRADLE_KEY }} -Pgradle.publish.secret=${{ secrets.GRADLE_SECRET }} --stacktrace --warning-mode all --no-configuration-cache
           ./gradlew :plugin-maven:changelogPush -Prelease=true --stacktrace --warning-mode all --no-configuration-cache
+          gh release create ${{ env.LIB_TAG }} --title '${{ env.LIB_NAME }}' --notes-file RELEASE_NOTES_FOR_LIB.md
+          gh release create ${{ env.PLUGIN_GRADLE_TAG }} --title '${{ env.PLUGIN_GRADLE_NAME }}' --notes-file RELEASE_NOTES_FOR_PLUGIN_GRADLE.md
+          gh release create ${{ env.PLUGIN_MAVEN_TAG }} --title '${{ env.PLUGIN_MAVEN_NAME }}' --notes-file RELEASE_NOTES_FOR_PLUGIN_MAVEN.md
       - name: publish just plugin-gradle
         if: "${{ github.event.inputs.to_publish == 'plugin-gradle' }}"
         run: |
           ./gradlew :plugin-gradle:changelogPush -Prelease=true -Pgradle.publish.key=${{ secrets.GRADLE_KEY }} -Pgradle.publish.secret=${{ secrets.GRADLE_SECRET }} --stacktrace --warning-mode all --no-configuration-cache
+          gh release create ${{ env.PLUGIN_GRADLE_TAG }} --title '${{ env.PLUGIN_GRADLE_NAME }}' --notes-file RELEASE_NOTES_FOR_PLUGIN_GRADLE.md
       - name: publish just plugin-maven
         if: "${{ github.event.inputs.to_publish == 'plugin-maven' }}"
         run: |
           ./gradlew :plugin-maven:changelogPush -Prelease=true --stacktrace --warning-mode all --no-configuration-cache
+          gh release create ${{ env.PLUGIN_MAVEN_TAG }} --title '${{ env.PLUGIN_MAVEN_NAME }}' --notes-file RELEASE_NOTES_FOR_PLUGIN_MAVEN.md
       - name: publish just lib
         if: "${{ github.event.inputs.to_publish == 'lib' }}"
         run: |
           ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all --no-configuration-cache
+          gh release create ${{ env.LIB_TAG }} --title '${{ env.LIB_NAME }}' --notes-file RELEASE_NOTES_FOR_LIB.md