release.yaml

# Cut a release whenever a new tag is pushed or via workflow_dispatch.
# Uses bazel-contrib release ruleset: build, attest, and publish to GitHub Releases.
name: Release
on:
  workflow_dispatch:
    inputs:
      tag_name:
        description: Git tag being released
        required: true
        type: string
  push:
    tags:
      - "v*.*.*"
permissions:
  id-token: write
  attestations: write
  contents: write
jobs:
  release:
    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.2
    with:
      release_files: archives/release.tar.gz
      prerelease: false
      tag_name: ${{ inputs.tag_name || github.ref_name }}
    permissions:
      id-token: write        # Needed to attest provenance
      attestations: write    # Needed to attest provenance
      contents: write       # Needed to upload release files
    secrets: {}