.github/workflows/publish.yaml

# Publish new releases to Bazel Central Registry.
name: Publish
on:
    # Run the publish workflow after a successful release
    # Will be triggered from the release.yaml workflow
    workflow_call:
        inputs:
            tag_name:
                required: true
                type: string
        secrets:
            BCR_PUBLISH_TOKEN:
                required: true
    # In case of problems, let release engineers retry by manually dispatching
    # the workflow from the GitHub UI
    workflow_dispatch:
        inputs:
            tag_name:
                description: The tag name of the release
                required: true
                type: string
jobs:
    publish:
        # SLSA trusted-builder reusable workflows MUST be referenced by a semantic
        # version tag, not a commit SHA: slsa-verifier reads the builder ref from the
        # provenance and rejects a bare SHA ("unexpected ref type"), which breaks the
        # source.json attestation that BCR's presubmit verifies. Do not SHA-pin this.
        uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.2.0
        with:
            draft: false
            tag_name: ${{ inputs.tag_name }}
            # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
            registry_fork: aspect-forks/bazel-central-registry
        permissions:
            attestations: write
            contents: write
            id-token: write
        secrets:
            # Necessary to push to the BCR fork, and to open a pull request against a registry
            publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}