Add releasing and publish-to-bcr workflows (#351)

Work towards https://github.com/bazelbuild/rules_java/issues/307

Closes #351

COPYBARA_INTEGRATE_REVIEW=https://github.com/bazelbuild/rules_java/pull/351 from bazelbuild:hvd_gh_release 8a853c71d68ed1ff8c32ea1187ae81b046c422b7
PiperOrigin-RevId: 871272493
Change-Id: I18daeeddd75f73b936de1a7dd0d3e2c7b8b09b9b

.github/workflows/publish.yaml

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
new file mode 100644
index 0000000..3652a52
--- /dev/null
+++ b/.github/workflows/publish.yaml
@@ -0,0 +1,32 @@
+name: Publish to BCR
+on:
+  # Run the publish workflow after a successful release
+  # Will be triggered from the release.yaml workflow
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+  # Permit release engineers to retry manually from the GitHub UI
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: git tag being released
+        required: true
+        type: string
+jobs:
+  publish:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.1.0
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
+      registry_fork: bazel-io/bazel-central-registry
+      draft: false
+      attest: true
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    secrets:
+      # Necessary to push to the BCR fork, and to open a pull request against a registry
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
\ No newline at end of file

.github/workflows/release.yaml

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..29c7bfb
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,27 @@
+# Automatically perform a release whenever a new "release-like" tag is pushed to the repo.
+name: Release
+
+on:
+  push:
+    tags:
+    # Detect tags that look like a release.
+    - "*.*.*"
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+jobs:
+  release:
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.3
+    with:
+      tag_name: ${{ github.ref_name }}
+      prerelease: false
+      draft: false
+      generate_release_notes: true
+      release_files: bazel-bin/distro/rules_java-*.tar.gz
+      bazel_test_command: "bazel test //test/... -//test:docs_up_to_date_test"
+  publish:
+    needs: release
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ github.ref_name }}

.github/workflows/release_prep.sh

diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
new file mode 100755
index 0000000..3173376
--- /dev/null
+++ b/.github/workflows/release_prep.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+
+RELEASE_VERSION=${1}
+
+# update MODULE.bazel with the version number
+sed -i "3s/version = \"0.0.0\"/version = \"${RELEASE_VERSION}\"/" MODULE.bazel
+
+# create release artifacts
+bazel build //distro:relnotes //distro:rules_java-${RELEASE_VERSION}.tar.gz
+
+# revert change to MODULE.bazel
+git checkout -- MODULE.bazel
+
+# print the release notes for release.yaml
+cat bazel-bin/distro/relnotes.txt

MODULE.bazel

diff --git a/MODULE.bazel b/MODULE.bazel
index 70e975f..47354f6 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -1,6 +1,6 @@
 module(
     name = "rules_java",
-    version = "9.5.0",
+    version = "0.0.0",
     bazel_compatibility = [">=7.0.0"],
     compatibility_level = 1,
 )