Publish tagged releases to the Bazel Central Registry

.bcr/README.md

@@ -11,8 +11,11 @@ The repository's **Release tags** ruleset restricts creation, updates, and delet
 of `v*` tags to maintainers and administrators. Release authority is managed in
 GitHub repository settings.
 
-The BCR templates use that release asset. Registry submission is a separate step;
-these templates follow [publish-to-bcr](https://github.com/bazel-contrib/publish-to-bcr/tree/main/templates/.bcr).
+The BCR templates use that release asset. The same tag runs
+[Publish to BCR](../.github/workflows/publish.yaml), which opens a pull request
+from `Physical-Intelligence/bazel-central-registry`. The first version of a
+module still needs a registry maintainer to merge it. Templates follow
+[publish-to-bcr](https://github.com/bazel-contrib/publish-to-bcr/tree/main/templates/.bcr).
 
 For a local rehearsal:
 

.github/workflows/publish.yaml

@@ -0,0 +1,34 @@
+name: Publish to BCR
+
+on:
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      publish_token:
+        required: true
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: git tag being released
+        required: true
+        type: string
+
+jobs:
+  publish:
+    # Semantic version reference required so SLSA verification accepts the builder.
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.5.1
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      registry_fork: Physical-Intelligence/bazel-central-registry
+      # The token belongs to a person. Mark the registry pull request ready for
+      # review after it opens; that is what lets the author satisfy review.
+      draft: true
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    secrets:
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}

.github/workflows/release.yaml

@@ -25,3 +25,15 @@ jobs:
         dist/rules_layer_optimizer-*.tar.gz
         dist/source.json
         dist/installation.MODULE.bazel
+
+  publish:
+    needs: release
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ github.ref_name }}
+    secrets:
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}