From cdbb075e8b60254515492401ec6341bccd8162f8 Mon Sep 17 00:00:00 2001
From: helly25 <6420169+helly25@users.noreply.github.com>
Date: Sun, 14 Jun 2026 18:37:14 +0100
Subject: [PATCH] ci: auto-publish releases to the BCR via reusable workflow

Mirror bashtest: add publish.yaml (bazel-contrib/publish-to-bcr@v1.4.1,
registry_fork helly25/bazel-central-registry, draft PR, URL-based
integrity) and hook it into release.yml after the release job. Replaces
the retired publish-to-bcr GitHub App.

Permissions match the proven pattern: the publish job grants contents:
write (a called reusable workflow can't exceed the caller's grant) and
publish.yaml carries no top-level read-all.
---
 .github/workflows/publish.yaml | 35 ++++++++++++++++++++++++++++++++++
 .github/workflows/release.yml  | 14 ++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 .github/workflows/publish.yaml

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
new file mode 100644
index 0000000..d894ec8
--- /dev/null
+++ b/.github/workflows/publish.yaml
@@ -0,0 +1,35 @@
+# Publish a new release to the Bazel Central Registry (BCR).
+#
+# Called by release.yml after a release is cut. Can also be run manually from
+# the Actions UI ("Run workflow") against a release tag to retry a failed run.
+name: Publish to BCR
+
+on:
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      BCR_PUBLISH_TOKEN:
+        required: true
+  workflow_dispatch: {}
+
+jobs:
+  publish:
+    permissions:
+      contents: write
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.4.1
+    with:
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+      registry_fork: helly25/bazel-central-registry
+      # Personal-account PAT: open a draft PR so the author can click "Ready for
+      # review" to approve it (GitHub forbids reviewing your own PR).
+      draft: true
+      # Integrity is computed from the tarball URL in .bcr/source.template.json.
+      # (The release also produces SLSA attestations; flip attest:true +
+      # download_default_release_artifacts:true to have the BCR verify them.)
+      attest: false
+      download_default_release_artifacts: false
+    secrets:
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 110b05b..c7bfaa1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,3 +14,17 @@ jobs:
     with:
       release_files: bzl-*.tar.gz
       prerelease: true
+
+  # Mirror the release to the Bazel Central Registry (replaces the retired
+  # publish-to-bcr GitHub App). See .github/workflows/publish.yaml.
+  publish:
+    needs: release
+    # Grant what publish.yaml's job requests; a called workflow cannot exceed
+    # the caller's permissions.
+    permissions:
+      contents: write
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ github.ref_name }}
+    secrets:
+      BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}