.github/workflows/publish.yaml

name: Publish to BCR
on:
  release:
    types: [released]
  workflow_dispatch:
    inputs:
      tag_name:
        description: The release tag to publish to the BCR, e.g. v2.4.0
        required: true
        type: string

jobs:
  publish:
    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.4.2
    permissions:
      contents: write # Upload release files / read the release
      id-token: write # Attest provenance
      attestations: write # Attest provenance
    with:
      tag_name: ${{ github.event.release.tag_name || inputs.tag_name }}
      registry_fork: bazel-contrib/bazel-central-registry
      # release.yml does not produce attestations (it uses
      # softprops/action-gh-release, not the bazel-contrib reusable release
      # workflow), so skip attestation upload.
      attest: false
      draft: false
    secrets:
      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}