release.yml

# Cut a release whenever a new tag is pushed to the repo.
name: Release

on:
  # Can be triggered from the tag.yaml workflow
  workflow_call:
    inputs:
      tag_name:
        required: true
        type: string
    secrets:
      BCR_PUBLISH_TOKEN:
        required: true
  # In case of problems, let release engineers retry by manually dispatching
  # the workflow from the GitHub UI
  workflow_dispatch:
    inputs:
      tag_name:
        required: true
        type: string
  # Or, developers can manually push a tag from their clone
  push:
    tags:
      - "v*.*.*"

permissions:
  id-token: write # Needed to attest provenance
  attestations: write # Needed to attest provenance
  contents: write # Needed to create release

jobs:
  build:
    # Go cross-compilation works from linux -> any platform
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build Go Binaries
        env:
          # NB: this variable is read by tools/release/copy_release_artifacts.sh
          # and must match the path in release_prep.sh under RELEASED_BINARY_INTEGRITY
          DEST: binaries
        run: |
          rm -rf ${{ env.DEST }}
          mkdir -p ${{ env.DEST }}
          bazel --bazelrc=.github/workflows/ci.bazelrc \
            run --config=release //tools/release:copy_release_artifacts
      - uses: actions/upload-artifact@v4
        with:
          name: go-binaries
          path: binaries/
          retention-days: 1

  release:
    needs: build
    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.3
    with:
      prerelease: false
      release_files: |
        go-binaries/*
        rules_lint-*.tar.gz
      tag_name: ${{ inputs.tag_name || github.ref_name }}
  publish:
    needs: release
    uses: ./.github/workflows/publish.yaml
    with:
      tag_name: ${{ inputs.tag_name || github.ref_name }}
    secrets:
      BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}