From 4774c6e00ec305bd14bdabbfcdae395e441bdb5c Mon Sep 17 00:00:00 2001
From: Jimmy Tanner <jimmyt857@gmail.com>
Date: Mon, 5 Oct 2026 01:53:22 +0000
Subject: [PATCH] Publish tagged releases to the Bazel Central Registry.

The GitHub App is gone, so a version tag now opens the registry pull request from the org fork.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .bcr/README.md                 |  7 +++++--
 .github/workflows/publish.yaml | 34 ++++++++++++++++++++++++++++++++++
 .github/workflows/release.yaml | 12 ++++++++++++
 3 files changed, 51 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/publish.yaml

diff --git a/.bcr/README.md b/.bcr/README.md
index 197ab11..d1c4918 100644
--- a/.bcr/README.md
+++ b/.bcr/README.md
@@ -11,8 +11,11 @@ The repository's **Release tags** ruleset restricts creation, updates, and delet
 of `v*` tags to maintainers and administrators. Release authority is managed in
 GitHub repository settings.
 
-The BCR templates use that release asset. Registry submission is a separate step;
-these templates follow [publish-to-bcr](https://github.com/bazel-contrib/publish-to-bcr/tree/main/templates/.bcr).
+The BCR templates use that release asset. The same tag runs
+[Publish to BCR](../.github/workflows/publish.yaml), which opens a pull request
+from `Physical-Intelligence/bazel-central-registry`. The first version of a
+module still needs a registry maintainer to merge it. Templates follow
+[publish-to-bcr](https://github.com/bazel-contrib/publish-to-bcr/tree/main/templates/.bcr).
 
 For a local rehearsal:
 
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
new file mode 100644
index 0000000..0a371f4
--- /dev/null
+++ b/.github/workflows/publish.yaml
@@ -0,0 +1,34 @@
+name: Publish to BCR
+
+on:
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      publish_token:
+        required: true
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: git tag being released
+        required: true
+        type: string
+
+jobs:
+  publish:
+    # Semantic version reference required so SLSA verification accepts the builder.
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.5.1
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      registry_fork: Physical-Intelligence/bazel-central-registry
+      # The token belongs to a person. Mark the registry pull request ready for
+      # review after it opens; that is what lets the author satisfy review.
+      draft: true
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    secrets:
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 19b6be8..59a9834 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -25,3 +25,15 @@ jobs:
         dist/rules_layer_optimizer-*.tar.gz
         dist/source.json
         dist/installation.MODULE.bazel
+
+  publish:
+    needs: release
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ github.ref_name }}
+    secrets:
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}