Limit Bazel Central Registry publishes to release tags

.bcr/README.md

@@ -13,8 +13,10 @@ GitHub repository settings.
 
 The BCR templates use that release asset. The same tag runs
 [Publish to BCR](../.github/workflows/publish.yaml), which opens a pull request
-from `Physical-Intelligence/bazel-central-registry`. The first version of a
-module still needs a registry maintainer to merge it. Templates follow
+from `Physical-Intelligence/bazel-central-registry`. There is no manual
+dispatch. The publish token is the `bcr` environment secret `PUBLISH_TOKEN`,
+and that environment allows only `v*` tags. The first version of a module still
+needs a registry maintainer to merge it. Templates follow
 [publish-to-bcr](https://github.com/bazel-contrib/publish-to-bcr/tree/main/templates/.bcr).
 
 For a local rehearsal:

.github/workflows/publish.yaml

@@ -6,15 +6,6 @@ on:
       tag_name:
         required: true
         type: string
-    secrets:
-      publish_token:
-        required: true
-  workflow_dispatch:
-    inputs:
-      tag_name:
-        description: git tag being released
-        required: true
-        type: string
 
 jobs:
   publish:
@@ -23,6 +14,8 @@ jobs:
     with:
       tag_name: ${{ inputs.tag_name }}
       registry_fork: Physical-Intelligence/bazel-central-registry
+      # The publish token lives in this environment, which allows only v* tags.
+      environment: bcr
       # The token belongs to a person. Mark the registry pull request ready for
       # review after it opens; that is what lets the author satisfy review.
       draft: true
@@ -31,4 +24,4 @@ jobs:
       contents: write
       id-token: write
     secrets:
-      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
+      publish_token: ${{ secrets.PUBLISH_TOKEN }}

.github/workflows/release.yaml

@@ -35,5 +35,3 @@ jobs:
     uses: ./.github/workflows/publish.yaml
     with:
       tag_name: ${{ github.ref_name }}
-    secrets:
-      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}