.github/workflows: define release-bazel and call from release

Thanks very much to Jeremy Kun for figuring this all out.

Change-Id: I3b6ec01ec6cd71b8f2a53bea71d17a58efe4f9b1
Reviewed-on: https://code-review.googlesource.com/c/re2/+/63892
Reviewed-by: Yun Peng <pcloudy@google.com>
Reviewed-by: Russ Cox <rsc@swtch.com>
Reviewed-by: Jeremy Kun <jkun@google.com>

.github/workflows/release-bazel.yml

@@ -0,0 +1,30 @@
+name: Release (Bazel)
+on:
+  # Allow manual triggering from GH UI
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+  # Automated trigger from the release.yaml workflow
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+jobs:
+  release:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v0.2.2
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      # This workflow seems to require keeping a fork of the upstream to open
+      # PRs from.
+      registry_fork: re2-machine/bazel-central-registry
+      attest: true
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    secrets:
+      # Necessary to push to the BCR fork, and to open a pull request against a registry
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}

.github/workflows/release.yml

@@ -37,3 +37,10 @@ jobs:
             *.tar.gz *.zip *.sigstore* \
             --repo "${GITHUB_REPOSITORY}"
         shell: bash
+  create_bazel:
+    needs: create
+    uses: ./.github/workflows/release-bazel.yaml
+    with:
+      tag_name: ${{ github.ref_name }}
+    secrets:
+      BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}