name: Release
on:
  # Can be triggered from the tag.yaml workflow
  workflow_call:
    inputs:
      tag_name:
        required: true
        type: string
    secrets:
      publish_token:
        required: true
  # Or, developers can manually push a tag from their clone
  push:
    tags:
      - "*.*.*"
permissions:
  id-token: write
  attestations: write
  contents: write
jobs:
  release:
    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.2
    with:
      # Matches both the main and Gazelle plugin archives
      release_files: bazel-skylib-*.tar.gz
      prerelease: false
      tag_name: ${{ inputs.tag_name || github.ref_name }}
  publish:
    needs: release
    uses: ./.github/workflows/publish.yaml
    with:
      tag_name: ${{ inputs.tag_name || github.ref_name }}
    secrets:
      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}