Fix BCR publishing

.github/workflows/main.yml

@@ -20,7 +20,7 @@ jobs:
         run: bazel run @buildifier_prebuilt//:buildifier -- -mode check -lint warn -r .
 
   build-bzlmod:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: "Checkout the sources"
         uses: actions/checkout@v4.2.2
@@ -40,7 +40,7 @@ jobs:
       - name: "Integration tests"
         run: bash tests/integration/suite.sh
   build-workspace:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: "Checkout the sources"
         uses: actions/checkout@v4.2.2

.github/workflows/publish.yaml

@@ -0,0 +1,28 @@
+name: Publish to BCR
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: The release tag to publish to the BCR, e.g. v0.4.2
+        required: true
+        type: string
+
+jobs:
+  publish:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.4.2
+    permissions:
+      contents: write # Upload release files / read the release
+      id-token: write # Attest provenance
+      attestations: write # Attest provenance
+    with:
+      tag_name: ${{ github.event.release.tag_name || inputs.tag_name }}
+      registry_fork: bazel-contrib/bazel-central-registry
+      # release.yml uses bazel-contrib/.github@v7, which does not produce
+      # attestations, so skip attestation upload.
+      attest: false
+      draft: false
+    secrets:
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}