Skip to content

Commit d450e1f

Browse files
committed
Migrate from Publish to BCR app to workflow
Replace the GitHub App-based BCR publishing with the reusable workflow from bazel-contrib/publish-to-bcr. This adds a new publish.yaml workflow that runs after a successful release, and updates release.yml to call it. Also updates the release_ruleset reusable workflow from v6 to v7.2.2 and adds the required permissions for artifact attestations.
1 parent 5132dd4 commit d450e1f

2 files changed

Lines changed: 48 additions & 7 deletions

File tree

.github/workflows/publish.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Publish new releases to Bazel Central Registry.
2+
name: Publish to BCR
3+
on:
4+
# Run the publish workflow after a successful release
5+
# Will be triggered from the release.yaml workflow
6+
workflow_call:
7+
inputs:
8+
tag_name:
9+
required: true
10+
type: string
11+
secrets:
12+
publish_token:
13+
required: true
14+
# In case of problems, let release engineers retry by manually dispatching
15+
# the workflow from the GitHub UI
16+
workflow_dispatch:
17+
inputs:
18+
tag_name:
19+
description: git tag being released
20+
required: true
21+
type: string
22+
jobs:
23+
publish:
24+
uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.1.0
25+
with:
26+
tag_name: ${{ inputs.tag_name }}
27+
# GitHub repository which is a fork of the upstream where the Pull Request will be opened.
28+
registry_fork: bazel-contrib/bazel-central-registry
29+
draft: false
30+
permissions:
31+
attestations: write
32+
contents: write
33+
id-token: write
34+
secrets:
35+
# Necessary to push to the BCR fork, and to open a pull request against a registry
36+
publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}

.github/workflows/release.yml

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,24 @@
11
# Cut a release whenever a new tag is pushed to the repo.
2-
# You should use an annotated tag, like `git tag -a v1.2.3`
3-
# and put the release notes into the commit message for the tag.
42
name: Release
5-
63
on:
74
push:
85
tags:
96
- "v*.*.*"
10-
117
permissions:
8+
id-token: write
9+
attestations: write
1210
contents: write
13-
1411
jobs:
1512
release:
16-
uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v6
13+
uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.2
1714
with:
18-
prerelease: false
1915
release_files: rules_shell-*.tar.gz
16+
prerelease: false
17+
tag_name: ${{ inputs.tag_name || github.ref_name }}
18+
publish:
19+
needs: release
20+
uses: ./.github/workflows/publish.yaml
21+
with:
22+
tag_name: ${{ inputs.tag_name || github.ref_name }}
23+
secrets:
24+
publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}

0 commit comments

Comments
 (0)