Skip to content

Commit f9798f3

Browse files
mblandmbland
committed
Use the Publish to BCR reusable GitHub workflow
Updates `.github/workflows/release.yml` and adds `publish-to-bcr.yml` for publishing to the Bazel Central Registry. Part of bazel-contrib#1482 (originally broken out from bazel-contrib#1722). `release.yml` now uses the `release_ruleset` workflow from `bazel-contrib/.github`, which does everything `release.yml` did previously and adds SLSA provenance attestations. `release.yml` then invokes the new `publish-to-bcr.yml` workflow after publishing a successful release to GitHub. Requires that the `BCR_PUBLISH_TOKEN` GitHub secret and the `registry_fork` specified in `.github/workflows/publish-to-bcr.yml` are in place. See `.bcr/README.md` for all the details and references. --- This will enable automated publishing to https://registry.bazel.build/.
1 parent 84e3f44 commit f9798f3

File tree

3 files changed

+130
-21
lines changed

3 files changed

+130
-21
lines changed

‎.bcr/README.md

+59-5
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,70 @@
11
# Bazel Central Registry publication
22

3-
The [Publish to BCR GitHub app](https://github.com/bazel-contrib/publish-to-bcr)
4-
uses these configuration files for publishing Bazel modules to the [Bazel
5-
Central Registry (BCR)](https://registry.bazel.build/).
3+
[.github/workflows/publish-to-bcr.yml](../.github/workflows/publish-to-bcr.yml)
4+
uses these files to configure the [Publish to BCR](
5+
https://github.com/bazel-contrib/publish-to-bcr) workflow for publishing to the
6+
[Bazel Central Registry (BCR)](https://registry.bazel.build/).
67

78
- [Publish to BCR workflow setup](
8-
https://github.com/bazel-contrib/publish-to-bcr/tree/main/README.md#setup)
9+
https://github.com/bazel-contrib/publish-to-bcr?tab=readme-ov-file#setup)
910
- [.bcr/ templates](
1011
https://github.com/bazel-contrib/publish-to-bcr/tree/main/templates)
12+
- [.github/workflows/publish.yaml reusable workflow](
13+
https://github.com/bazel-contrib/publish-to-bcr/blob/main/.github/workflows/publish.yaml)
1114

12-
Related documentation:
15+
Notice that the setup instructions suggest saving the Personal Access Token as
16+
`PUBLISH_TOKEN`. We save it as `BCR_PUBLISH_TOKEN` instead, as inspired by
17+
aspect-build/rules_lint#529, to make this value more self documenting.
18+
19+
## Provenance attestations
20+
21+
This workflow also produces attestations required by the [Supply chain Levels
22+
for Software Artifacts (SLSA)](https://slsa.dev/) framework for secure supply
23+
chain provenance.
24+
25+
Examples:
26+
27+
<!-- Replace these with rules_scala examples once they're available. -->
28+
- [aspect-build/rules_lint v1.3.4 release and publish run with attestations](
29+
https://github.com/aspect-build/rules_lint/actions/runs/14410869652/attempts/1)
30+
- [aspect-build/rules_lint v1.3.4 attestations](
31+
https://github.com/aspect-build/rules_lint/attestations/6280291)
32+
- [aspect-build/rules_lint attestations](
33+
https://github.com/aspect-build/rules_lint/attestations)
34+
35+
## Related documentation
1336

1437
- [bazelbuild/bazel-central-registry](
1538
https://github.com/bazelbuild/bazel-central-registry)
39+
- [SLSA: Provenance](https://slsa.dev/spec/v1.0/provenance)
40+
- [in-toto](https://in-toto.io/)
1641
- [GitHub Actions](https://docs.github.com/actions)
42+
- [Security for GitHub Actions](
43+
https://docs.github.com/en/actions/security-for-github-actions)
44+
- [Using secrets in a workflow](
45+
https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow)
46+
- [Using artifact attestations](
47+
https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations)
48+
- [Writing Workflows](
49+
https://docs.github.com/en/actions/writing-workflows)
50+
- [Accessing contextual information about workflow runs: 'secrets' context](
51+
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#secrets-context)
52+
- [Workflow syntax for GitHub Action: 'on.workflow_call.secrets'](
53+
https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets)
54+
- [Sharing automations](https://docs.github.com/en/actions/sharing-automations)
55+
- [Passing inputs and secrets to a reusable workflow](
56+
https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow)
57+
- [actions/attest-build-provenance](
58+
https://github.com/actions/attest-build-provenance)
59+
- [in-toto/attestation](https://github.com/in-toto/attestation)
60+
- [slsa-framework/slsa-verifier](
61+
https://github.com/slsa-framework/slsa-verifier)
62+
63+
## Inspiration
64+
65+
Originally based on the examples from aspect-build/rules_lint#498 and
66+
aspect-build/rules_lint#501. See also:
67+
68+
- bazelbuild/bazel-central-registry#4060
69+
- bazelbuild/bazel-central-registry#4146
70+
- slsa-framework/slsa-verifier#840

‎.github/workflows/publish-to-bcr.yml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Publishes to the Bazel Central Registry.
2+
#
3+
# Based on .github/workflows/publish.yaml from aspect-build/rules_lint v1.3.5.
4+
# See .bcr/README.md.
5+
name: Publish to the Bazel Central Registry
6+
7+
on:
8+
# Run from release.yml.
9+
workflow_call:
10+
inputs:
11+
tag_name:
12+
required: true
13+
type: string
14+
secrets:
15+
bcr_publish_token:
16+
required: true
17+
18+
# In case of problems, enable manual dispatch from the GitHub UI.
19+
workflow_dispatch:
20+
inputs:
21+
tag_name:
22+
required: true
23+
type: string
24+
25+
jobs:
26+
publish-to-bcr:
27+
uses: bazel-contrib/publish-to-bcr/.github/workflows/[email protected]
28+
with:
29+
tag_name: ${{ inputs.tag_name }}
30+
# bazelbuild/bazel-central-registry fork used to open a pull request.
31+
registry_fork: simuons/bazel-central-registry
32+
permissions:
33+
attestations: write
34+
contents: write
35+
id-token: write
36+
secrets:
37+
# Necessary to push to the BCR fork and open a pull request.
38+
publish_token: ${{ secrets.bcr_publish_token }}

‎.github/workflows/release.yml

+33-16
Original file line numberDiff line numberDiff line change
@@ -7,21 +7,38 @@ on:
77
tags:
88
- 'v*.*.*'
99

10-
jobs:
11-
build:
12-
runs-on: ubuntu-latest
13-
steps:
14-
- name: Checkout
15-
uses: actions/checkout@v3
10+
# In case of problems, enable manual dispatch from the GitHub UI.
11+
workflow_dispatch:
12+
inputs:
13+
tag_name:
14+
required: true
15+
type: string
16+
17+
# Uses the `release_ruleset` workflow to generate provenance attestation files
18+
# referenced by the `publish-to-bcr` workflow.
19+
#
20+
# Based on .github/workflows/release.yml from aspect-build/rules_lint v1.3.5.
21+
# See .bcr/README.md.
1622

17-
- name: Prepare workspace snippet
18-
run: .github/workflows/workspace_snippet.sh ${{ env.GITHUB_REF_NAME }} > release_notes.txt
23+
permissions:
24+
attestations: write # Needed to attest provenance
25+
contents: write # Needed to create release
26+
id-token: write # Needed to attest provenance
27+
28+
jobs:
29+
release:
30+
uses: bazel-contrib/.github/.github/workflows/[email protected]
31+
with:
32+
bazel_test_command: "bazel test //src/... //test/... //third_party/..."
33+
prerelease: false
34+
release_files: rules_scala-*.tar.gz
35+
release_prep_command: .github/workflows/workspace_snippet.sh
36+
tag_name: ${{ inputs.tag_name || github.ref_name }}
1937

20-
- name: Release
21-
uses: softprops/action-gh-release@v1
22-
with:
23-
# Use GH feature to populate the changelog automatically
24-
generate_release_notes: true
25-
body_path: release_notes.txt
26-
fail_on_unmatched_files: true
27-
files: rules_scala-*.tar.gz
38+
publish-to-bcr:
39+
needs: release
40+
uses: ./.github/workflows/publish-to-bcr.yml
41+
with:
42+
tag_name: ${{ inputs.tag_name || github.ref_name }}
43+
secrets:
44+
bcr_publish_token: ${{ secrets.bcr_publish_token }}

0 commit comments

Comments
 (0)