fix tag refs, add tag input, secret input

Author: rickeylev

.github/workflows/release.yml

@@ -21,11 +21,17 @@ on:
       - "*.*.*"
   workflow_dispatch:
     inputs:
+      tag_name:
+        required: true
+        type: string
       publish_to_pypi:
         description: 'Publish to PyPI'
         required: true
         type: boolean
         default: true
+    secrets:
+      publish_token:
+        required: true
 
 jobs:
   release:
@@ -45,13 +51,13 @@ jobs:
           prerelease: ${{ contains(github.ref, '-rc') }}
           fail_on_unmatched_files: true
           files: rules_python-*.tar.gz
-          tag_name: 1.0.0  # TODO remove
+          tag_name: ${{ inputs.tag_name || github.ref_name }}
 
   publish:
     needs: release
     uses: ./.github/workflows/publish.yml
     with:
-      tag_name: ${{ github.ref_name }}
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
     secrets:
       BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}