From 3add5f4805d6f88916a19a681ed3d1bc875963ad Mon Sep 17 00:00:00 2001
From: Maxwell Elliott <maxwell.elliott@gotinder.com>
Date: Thu, 2 Apr 2026 15:03:11 -0400
Subject: [PATCH 1/2] Try attestation again

---
 .github/workflows/publish.yaml |  4 ++--
 .github/workflows/release.yaml | 13 ++++++++++---
 MODULE.bazel                   |  2 +-
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index a8cae8b..9df86e5 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -14,7 +14,7 @@ jobs:
       tag_name: ${{ inputs.tag_name }}
       # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
       registry_fork: maxwellE/bazel-central-registry
-      attest: false
+      attest: true
       author_name: Maxwell Elliott
       author_email: maxwell@elliott.now
       committer_name: Maxwell Elliott
@@ -25,4 +25,4 @@ jobs:
       attestations: write
     secrets:
       # Necessary to push to the BCR fork, and to open a pull request against a registry
-      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
\ No newline at end of file
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3874c4a..eeff158 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -23,7 +23,14 @@ jobs:
       prerelease: false
       tag_name: ${{ inputs.tag_name || github.ref_name }}
     permissions:
-      id-token: write        # Needed to attest provenance
-      attestations: write    # Needed to attest provenance
-      contents: write       # Needed to upload release files
+      id-token: write # Needed to attest provenance
+      attestations: write # Needed to attest provenance
+      contents: write # Needed to upload release files
     secrets: {}
+  publish:
+    needs: release
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+    secrets:
+      BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}
diff --git a/MODULE.bazel b/MODULE.bazel
index b214342..cf9a4e7 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -1,6 +1,6 @@
 module(
     name = "bazel-diff",
-    version = "18.0.0",
+    version = "18.0.1",
     compatibility_level = 0,
 )
 

From 2b0f9b7acebc836263cf08457aff1b7968aef851 Mon Sep 17 00:00:00 2001
From: Maxwell Elliott <maxwell.elliott@gotinder.com>
Date: Thu, 2 Apr 2026 15:29:32 -0400
Subject: [PATCH 2/2] more updates

---
 .github/workflows/publish.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 9df86e5..fe48f12 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -1,6 +1,14 @@
 # Publish new releases to Bazel Central Registry.
 name: Publish to BCR
 on:
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      BCR_PUBLISH_TOKEN:
+        required: true
   workflow_dispatch:
     inputs:
       tag_name:
@@ -9,7 +17,7 @@ on:
         type: string
 jobs:
   publish:
-    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.1.0
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.2.0
     with:
       tag_name: ${{ inputs.tag_name }}
       # GitHub repository which is a fork of the upstream where the Pull Request will be opened.