From bf6416bc00611a18f7686440cc2ae2c91a5e908a Mon Sep 17 00:00:00 2001 From: Russ Cox Date: Tue, 12 Aug 2025 18:04:55 -0400 Subject: [PATCH] .github/workflows/release-bazel: disable attestation The bazel attestations are too complicated for mortals like me. Also, the yanked_versions list is ignored in metadata.template.json, so delete its content. Change-Id: I28e05de4ca3391fd9c87189ff3be3aeedea95ac4 Reviewed-on: https://code-review.googlesource.com/c/re2/+/63971 Reviewed-by: Alan Donovan Reviewed-by: Russ Cox --- .bcr/metadata.template.json | 6 +----- .github/workflows/release-bazel.yml | 14 +++++++++++--- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.bcr/metadata.template.json b/.bcr/metadata.template.json index 97b07616..2ba3e16d 100644 --- a/.bcr/metadata.template.json +++ b/.bcr/metadata.template.json @@ -12,9 +12,5 @@ "github:google/re2" ], "versions": [], - "yanked_versions": { - "2023-06-02": "bad compatibility_level, upgrade to 2023-09-01 or newer", - "2023-08-01": "bad compatibility_level, upgrade to 2023-09-01 or newer", - "2025-06-26": "accidentally lost from github, upgrade to 2025-07-22 or newer" - } + "yanked_versions": {} } diff --git a/.github/workflows/release-bazel.yml b/.github/workflows/release-bazel.yml index 8bac4c45..16a0fcfc 100644 --- a/.github/workflows/release-bazel.yml +++ b/.github/workflows/release-bazel.yml @@ -20,11 +20,19 @@ jobs: release: uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v0.2.2 with: + draft: false tag_name: ${{ inputs.tag_name }} - # This workflow seems to require keeping a fork of the upstream to open - # PRs from. registry_fork: re2-machine/bazel-central-registry - attest: true + # NOTE: To use attest: true, we need a signed intoto.jsonl file, + # but that appears to require using + # the release_ruleset support described on + # https://github.com/bazel-contrib/publish-to-bcr?tab=readme-ov-file#attesation-support + # but that requires a release_prep.sh file, + # and an override on the test command, + # and may insist on doing the release upload of the source zip + # (which we do ourselves separately), + # and possibly more problems I didn't hit because I gave up. + attest: false # too hard to generate the intoto.jsonl file permissions: contents: write id-token: write