From 9719dde7a461a7672d4c986addf658f0c32944fa Mon Sep 17 00:00:00 2001
From: Jimmy Tanner <jimmyt857@gmail.com>
Date: Mon, 5 Oct 2026 02:32:17 +0000
Subject: [PATCH] Limit Bazel Central Registry publishes to release tags.

Remove manual dispatch and read the publish token from an environment that allows only v* tags.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .bcr/README.md                 |  6 ++++--
 .github/workflows/publish.yaml | 13 +++----------
 .github/workflows/release.yaml |  2 --
 3 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/.bcr/README.md b/.bcr/README.md
index d1c4918..0798df5 100644
--- a/.bcr/README.md
+++ b/.bcr/README.md
@@ -13,8 +13,10 @@ GitHub repository settings.
 
 The BCR templates use that release asset. The same tag runs
 [Publish to BCR](../.github/workflows/publish.yaml), which opens a pull request
-from `Physical-Intelligence/bazel-central-registry`. The first version of a
-module still needs a registry maintainer to merge it. Templates follow
+from `Physical-Intelligence/bazel-central-registry`. There is no manual
+dispatch. The publish token is the `bcr` environment secret `PUBLISH_TOKEN`,
+and that environment allows only `v*` tags. The first version of a module still
+needs a registry maintainer to merge it. Templates follow
 [publish-to-bcr](https://github.com/bazel-contrib/publish-to-bcr/tree/main/templates/.bcr).
 
 For a local rehearsal:
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 0a371f4..afe8da3 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -6,15 +6,6 @@ on:
       tag_name:
         required: true
         type: string
-    secrets:
-      publish_token:
-        required: true
-  workflow_dispatch:
-    inputs:
-      tag_name:
-        description: git tag being released
-        required: true
-        type: string
 
 jobs:
   publish:
@@ -23,6 +14,8 @@ jobs:
     with:
       tag_name: ${{ inputs.tag_name }}
       registry_fork: Physical-Intelligence/bazel-central-registry
+      # The publish token lives in this environment, which allows only v* tags.
+      environment: bcr
       # The token belongs to a person. Mark the registry pull request ready for
       # review after it opens; that is what lets the author satisfy review.
       draft: true
@@ -31,4 +24,4 @@ jobs:
       contents: write
       id-token: write
     secrets:
-      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
+      publish_token: ${{ secrets.PUBLISH_TOKEN }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 59a9834..180834b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -35,5 +35,3 @@ jobs:
     uses: ./.github/workflows/publish.yaml
     with:
       tag_name: ${{ github.ref_name }}
-    secrets:
-      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}