name: Publish to BCR

on:
  release:
    types: [published]

  # Allow manual triggering from GH UI
  workflow_dispatch:
    inputs:
      tag_name:
        description: 'Tag name to publish (e.g., v1.2.3)'
        required: true
        type: string

permissions:
  id-token: write
  attestations: write
  contents: write

jobs:
  publish:
    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.0.0
    with:
      tag_name: ${{ github.event.release.tag_name || inputs.tag_name }}
    secrets:
      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}