feat: configure new publish-to-bcr workflow

Author: alexeagle

.github/workflows/publish.yaml

@@ -0,0 +1,32 @@
+name: Publish To BCR
+
+on:
+  # Run the publish workflow after a successful release
+  # Can be triggered from the release.yaml workflow
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+  # In case of problems, let release engineers retry by manually dispatching
+  # the workflow from the GitHub UI
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+
+jobs:
+  publish:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@165f8b872b32a54bcc3c77156db4a74f54a51986 # 2025 March 14
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
+      registry_fork: aspect-build/bazel-central-registry
+    secrets:
+      publish_token: ${{ secrets.PUBLISH_TOKEN }}

.github/workflows/release.yml

@@ -15,8 +15,13 @@ on:
 
 jobs:
   release:
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@cb461f299b8d472a82d1d88c4cef7d6013721742 # 2024-12-03
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@540bb73a286db90d2f82d337d0adec21d3d54d7b # 2025-03-14
     with:
       prerelease: false
       release_files: rules_lint-*.tar.gz
       tag_name: ${{ inputs.tag_name }}
+  publish:
+    needs: release
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ inputs.tag_name }}