Add BCR publishing workflow

.bcr/gazelle/presubmit.yml

@@ -1,11 +1,14 @@
 matrix:
   platform:
-  - centos7
+  - rockylinux8
   - debian10
   - macos
-  - ubuntu2004
+  - macos_arm64
+  - ubuntu2204
+  - ubuntu2404
   - windows
   bazel:
+  - 8.x
   - 7.x
   - 6.x
 tasks:

.bcr/presubmit.yml

@@ -1,14 +1,16 @@
 matrix:
   platform:
-  - centos7
+  - rockylinux8
   - debian10
   - macos
-  - ubuntu2004
+  - macos_arm64
+  - ubuntu2204
+  - ubuntu2404
   - windows
   bazel:
+  - 8.x
   - 7.x
   - 6.x
-  - 5.x
 tasks:
   verify_build_targets:
     name: "Verify build targets"

.github/workflows/publish.yaml

@@ -0,0 +1,35 @@
+name: Publish to BCR
+on:
+  # Run the publish workflow after a successful release
+  # Will be triggered from the release.yaml workflow
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      publish_token:
+        required: true
+  # In case of problems, let release engineers retry by manually dispatching
+  # the workflow from the GitHub UI
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: git tag being released
+        required: true
+        type: string
+jobs:
+  publish:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v0.2.1
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
+      registry_fork: bazel-io/bazel-central-registry
+      draft: false
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    secrets:
+      # Necessary to push to the BCR fork, and to open a pull request against a registry
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}

.github/workflows/release.yaml

@@ -0,0 +1,34 @@
+name: Release
+on:
+  # Can be triggered from the tag.yaml workflow
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      publish_token:
+        required: true
+  # Or, developers can manually push a tag from their clone
+  push:
+    tags:
+      - "*.*.*"
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+jobs:
+  release:
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.2
+    with:
+      # Matches both the main and Gazelle plugin archives
+      release_files: bazel-skylib-*.tar.gz
+      prerelease: false
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+  publish:
+    needs: release
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+    secrets:
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}

.github/workflows/release_prep.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+
+# Argument provided by reusable workflow caller, see
+# https://github.com/bazel-contrib/.github/blob/d197a6427c5435ac22e56e33340dff912bc9334e/.github/workflows/release_ruleset.yaml#L72
+VERSION=$1
+
+bazel build //distribution:bazel-skylib
+ARCHIVE="$(bazel cquery --output=files //distribution:bazel-skylib)"
+SHA256SUM=$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')
+
+bazel build //distribution:bazel-skylib-gazelle-plugin
+ARCHIVE_GAZELLE_PLUGIN="$(bazel cquery --output=files //distribution:bazel-skylib-gazelle-plugin)"
+SHA256SUM_GAZELLE_PLUGIN=$(shasum -a 256 "$ARCHIVE_GAZELLE_PLUGIN" | awk '{print $1}')
+
+cat << EOF
+**MODULE.bazel setup**
+
+\`\`\`starlark
+bazel_dep(name = "bazel_skylib", version = "$VERSION")
+\`\`\`
+
+And for the Gazelle plugin:
+
+\`\`\`starlark
+bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "$VERSION", dev_dependency = True)
+\`\`\`
+
+**WORKSPACE setup**
+
+\`\`\`starlark
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "bazel_skylib",
+    sha256 = "$SHA256SUM",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/bazel-skylib-$VERSION.tar.gz",
+        "https://github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/bazel-skylib-$VERSION.tar.gz",
+    ],
+)
+
+load("@bazel_skylib//:workspace.bzl", "bazel_skylib_workspace")
+
+bazel_skylib_workspace()
+\`\`\`
+
+***Additional WORKSPACE setup for the Gazelle plugin***
+
+\`\`\`starlark
+http_archive(
+    name = "bazel_skylib_gazelle_plugin",
+    sha256 = "$SHA256SUM_GAZELLE_PLUGIN",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/bazel-skylib-gazelle-plugin-$VERSION.tar.gz",
+        "https://github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/bazel-skylib-gazelle-plugin-$VERSION.tar.gz",
+    ],
+)
+
+load("@bazel_skylib_gazelle_plugin//:workspace.bzl", "bazel_skylib_gazelle_plugin_workspace")
+
+bazel_skylib_gazelle_plugin_workspace()
+
+load("@bazel_skylib_gazelle_plugin//:setup.bzl", "bazel_skylib_gazelle_plugin_setup")
+
+bazel_skylib_gazelle_plugin_setup()
+\`\`\`
+EOF

docs/maintainers_guide.md

@@ -77,100 +77,18 @@ Name 1, Name 2, Name 3 (alphabetically from `git log`)
 2.  Bump `version` in version.bzl, MODULE.bazel, *and* gazelle/MODULE.bazel to
     the new version.
     TODO(#386): add a test to make sure all the versions are in sync.
-3.  Ensure that the commits for steps 1 and 2 have been merged. All further
-    steps must be performed on a single, known-good git commit.
-4.  `bazel build //distribution`
-5.  Copy the `bazel-skylib-$VERSION.tar.gz` and
-    `bazel-skylib-gazelle-plugin-$VERSION.tar.gz` tarballs to the mirror (you'll
+3.  Ensure that the commits for steps 1 and 2 have been merged.
+4.  Create a new tag in the format `1.2.3` (no leading `v`) and push it to
+    GitHub.
+5.  Review a PR at [Bazel Central Registry](https://github.com/bazelbuild/bazel-central-registry)
+    created by the publish.yaml workflow.
+6.  Download the the `bazel-skylib-$VERSION.tar.gz` and
+    `bazel-skylib-gazelle-plugin-$VERSION.tar.gz` tarballs from the
+    automatically created GitHub release and upload them to the mirror (you'll
     need Bazel developer gcloud credentials; assuming you are a Bazel developer,
     you can obtain them via `gcloud init`):
 
 ```bash
-gsutil cp bazel-bin/distribution/bazel-skylib{,-gazelle-plugin}-$VERSION.tar.gz gs://bazel-mirror/github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/
+gsutil cp bazel-skylib{,-gazelle-plugin}-$VERSION.tar.gz gs://bazel-mirror/github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/
 gsutil setmeta -h "Cache-Control: public, max-age=31536000" gs://bazel-mirror/github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/bazel-skylib{,-gazelle-plugin}-$VERSION.tar.gz
 ```
-
-6.  Obtain checksums for release notes:
-
-```bash
-sha256sum bazel-bin/distribution/bazel-skylib-$VERSION.tar.gz
-sha256sum bazel-bin/distribution/bazel-skylib-gazelle-plugin-$VERSION.tar.gz
-````
-
-7.  Draft a new release with a new tag named $VERSION in github. Attach
-    `bazel-skylib-$VERSION.tar.gz` and
-    `bazel-skylib-gazelle-plugin-$VERSION.tar.gz` to the release. For the
-    release notes, use the CHANGELOG.md entry plus the following template:
-
---------------------------------------------------------------------------------
-
-**WORKSPACE setup**
-
-```
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-
-http_archive(
-    name = "bazel_skylib",
-    sha256 = "$SHA256SUM",
-    urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/bazel-skylib-$VERSION.tar.gz",
-        "https://github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/bazel-skylib-$VERSION.tar.gz",
-    ],
-)
-
-load("@bazel_skylib//:workspace.bzl", "bazel_skylib_workspace")
-
-bazel_skylib_workspace()
-```
-
-***Additional WORKSPACE setup for the Gazelle plugin***
-
-```starlark
-http_archive(
-    name = "bazel_skylib_gazelle_plugin",
-    sha256 = "$SHA256SUM_GAZELLE_PLUGIN",
-    urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/bazel-skylib-gazelle-plugin-$VERSION.tar.gz",
-        "https://github.com/bazelbuild/bazel-skylib/releases/download/$VERSION/bazel-skylib-gazelle-plugin-$VERSION.tar.gz",
-    ],
-)
-
-load("@bazel_skylib_gazelle_plugin//:workspace.bzl", "bazel_skylib_gazelle_plugin_workspace")
-
-bazel_skylib_gazelle_plugin_workspace()
-
-load("@bazel_skylib_gazelle_plugin//:setup.bzl", "bazel_skylib_gazelle_plugin_setup")
-
-bazel_skylib_gazelle_plugin_setup()
-```
-
-**Using the rules**
-
-See [the source](https://github.com/bazelbuild/bazel-skylib/tree/$VERSION).
-
---------------------------------------------------------------------------------
-
-8.  Review a PR at [Bazel Central Registry](https://github.com/bazelbuild/bazel-central-registry)
-    created by Publish-to-BCR plugin.
-
-    Use https://github.com/bazelbuild/bazel-central-registry/pull/403 as the
-    model.
-
-9.  Once the Bazel Central Registry PR is merged, insert in the release
-    description after the WORKSPACE setup section:
-
---------------------------------------------------------------------------------
-
-**MODULE.bazel setup**
-
-```starlark
-bazel_dep(name = "bazel_skylib", version = "$VERSION")
-```
-
-And for the Gazelle plugin:
-
-```starlark
-bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "$VERSION", dev_dependency = True)
-```
-
---------------------------------------------------------------------------------