chore: fix new BCR release (#501)

* refactor: modifications needed to perform release

* bump

* bump

* bump

* bump

* bump

* bump

* bump

Author: alexeagle

.github/workflows/publish.yaml

@@ -1,3 +1,6 @@
+# See https://github.com/bazel-contrib/publish-to-bcr
+name: Publish to BCR
+
 on:
   # Run the publish workflow after a successful release
   # Can be triggered from the release.yaml workflow
@@ -16,12 +19,14 @@ on:
 
 jobs:
   publish:
-    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@165f8b872b32a54bcc3c77156db4a74f54a51986 # 2025 March 14
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v0.0.1 # 2025 March 15
     with:
       tag_name: ${{ inputs.tag_name }}
       # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
       registry_fork: aspect-build/bazel-central-registry
     permissions:
+      attestations: write
       contents: write
+      id-token: write
     secrets:
       publish_token: ${{ secrets.PUBLISH_TOKEN }}

.github/workflows/release.yml

@@ -22,17 +22,19 @@ on:
 
 jobs:
   release:
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@540bb73a286db90d2f82d337d0adec21d3d54d7b # 2025-03-14
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.1 # 2025-03-17
     with:
       prerelease: false
       release_files: rules_lint-*.tar.gz
       tag_name: ${{ inputs.tag_name }}
     permissions:
       id-token: write # Needed to attest provenance
       attestations: write # Needed to attest provenance
+      contents: write # Needed to create release
   publish:
-    name: Publish to BCR
     needs: release
     uses: ./.github/workflows/publish.yaml
     with:
       tag_name: ${{ inputs.tag_name }}
+    permissions:
+      contents: write # allow appending new attestation files to the release