Use bazel contrib release rules

.github/workflows/release.yaml

@@ -0,0 +1,29 @@
+# Cut a release whenever a new tag is pushed or via workflow_dispatch.
+# Uses bazel-contrib release ruleset: build, attest, and publish to GitHub Releases.
+name: Release
+on:
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: Git tag being released
+        required: true
+        type: string
+  push:
+    tags:
+      - "v*.*.*"
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+jobs:
+  release:
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.2
+    with:
+      release_files: archives/release.tar.gz
+      prerelease: false
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+    permissions:
+      id-token: write        # Needed to attest provenance
+      attestations: write    # Needed to attest provenance
+      contents: write       # Needed to upload release files
+    secrets: {}

.github/workflows/release_prep.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+
+# Argument provided by reusable workflow caller, see
+# https://github.com/bazel-contrib/.github/blob/master/.github/workflows/release_ruleset.yaml
+TAG=$1
+
+mkdir -p archives
+tar --exclude-vcs \
+  --exclude=bazel-* \
+  --exclude=.github \
+  --exclude=archives \
+  --exclude=cli/src/test \
+  -zcf "archives/release.tar.gz" .
+
+SHA=$(shasum -a 256 archives/release.tar.gz | awk '{print $1}')
+
+cat << EOF
+## Using Bzlmod (MODULE.bazel)
+
+Add to your \`MODULE.bazel\` file:
+
+\`\`\`starlark
+bazel_dep(name = "bazel-diff", version = "${TAG#v}")
+\`\`\`
+
+## Using WORKSPACE
+
+\`\`\`starlark
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+http_archive(
+  name = "bazel-diff",
+  sha256 = "${SHA}",
+  strip_prefix = "",
+  url = "https://github.com/Tinder/bazel-diff/releases/download/${TAG}/release.tar.gz",
+)
+\`\`\`
+EOF