Add automated Bazel Central Registry publishing on release

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

Author: mmorel-35

.bcr/README.md

@@ -0,0 +1,38 @@
+# Bazel Central Registry (BCR) Publishing
+
+This directory contains template files for automated publishing to the [Bazel Central Registry (BCR)](https://github.com/bazelbuild/bazel-central-registry).
+
+## Overview
+
+When a new release tag is created, the GitHub Actions workflow automatically:
+1. Generates a BCR entry using these templates
+2. Creates attestations for the generated files
+3. Opens a pull request against the Bazel Central Registry
+
+## Files
+
+- **metadata.template.json**: Contains repository metadata and maintainer information
+- **source.template.json**: Defines the source archive location and format
+- **presubmit.yml**: Specifies BCR CI tests to validate the module
+
+## Workflow
+
+The publish workflow is triggered by:
+- Release publication (automatic)
+- Manual workflow dispatch (for retries or re-publishing)
+
+See `.github/workflows/publish.yaml` and `.github/workflows/release.yml` for the workflow configuration.
+
+## Requirements
+
+The workflow requires a `BCR_PUBLISH_TOKEN` secret to be configured in the repository settings. This should be a GitHub Personal Access Token with:
+- `repo` scope
+- `workflow` scope
+
+The token should be created by someone with write access to a fork of the bazel-central-registry.
+
+## References
+
+- [Publish to BCR documentation](https://github.com/bazel-contrib/publish-to-bcr)
+- [BCR templates](https://github.com/bazel-contrib/publish-to-bcr/tree/main/templates)
+- [Bazel Central Registry](https://github.com/bazelbuild/bazel-central-registry)

.bcr/metadata.template.json

@@ -0,0 +1,21 @@
+{
+  "homepage": "https://github.com/google/flatbuffers",
+  "maintainers": [
+    {
+      "name": "Derek Bailey",
+      "github": "dbaileychess",
+      "github_user_id": 1477247
+    },
+    {
+      "name": "mering",
+      "github": "mering",
+      "github_user_id": 133344217
+    }
+  ],
+  "_comment": "maintainers will be emailed if a BCR release fails; add additional maintainers as needed",
+  "repository": [
+    "github:google/flatbuffers"
+  ],
+  "versions": [],
+  "yanked_versions": {}
+}

.bcr/presubmit.yml

@@ -0,0 +1,43 @@
+---
+matrix:
+  bazel:
+    - 7.x
+    - 8.x
+tasks:
+  verify_ubuntu2004:
+    name: Test Ubuntu 20.04
+    platform: ubuntu2004
+    bazel: ${{ bazel }}
+    environment:
+      CC: clang
+      SWIFT_VERSION: "5.8"
+      SWIFT_HOME: "$HOME/swift-$SWIFT_VERSION"
+      PATH: "$PATH:$SWIFT_HOME/usr/bin"
+    shell_commands:
+      - "echo --- Downloading and extracting Swift $SWIFT_VERSION to $SWIFT_HOME"
+      - "mkdir $SWIFT_HOME"
+      - "curl https://download.swift.org/swift-${SWIFT_VERSION}-release/ubuntu2004/swift-${SWIFT_VERSION}-RELEASE/swift-${SWIFT_VERSION}-RELEASE-ubuntu20.04.tar.gz | tar xvz --strip-components=1 -C $SWIFT_HOME"
+    build_targets:
+    - "@flatbuffers//:*"
+  verify_ubuntu2204:
+    name: Test Ubuntu 22.04
+    platform: ubuntu2204
+    bazel: ${{ bazel }}
+    environment:
+      CC: clang
+      SWIFT_VERSION: "5.8"
+      SWIFT_HOME: "$HOME/swift-$SWIFT_VERSION"
+      PATH: "$PATH:$SWIFT_HOME/usr/bin"
+    shell_commands:
+      - "echo --- Downloading and extracting Swift $SWIFT_VERSION to $SWIFT_HOME"
+      - "mkdir $SWIFT_HOME"
+      - "curl https://download.swift.org/swift-${SWIFT_VERSION}-release/ubuntu2204/swift-${SWIFT_VERSION}-RELEASE/swift-${SWIFT_VERSION}-RELEASE-ubuntu22.04.tar.gz | tar xvz --strip-components=1 -C $SWIFT_HOME"
+    build_targets:
+    - "@flatbuffers//:*"
+  verify_macos:
+    name: Test macOS
+    platform: macos
+    bazel: ${{ bazel }}
+    xcode_version: "15.2"
+    build_targets:
+    - "@flatbuffers//:*"

.bcr/source.template.json

@@ -0,0 +1,5 @@
+{
+  "url": "https://github.com/{OWNER}/{REPO}/archive/refs/tags/{TAG}.tar.gz",
+  "integrity": "",
+  "strip_prefix": "{REPO}-{VERSION}"
+}

.github/workflows/publish.yaml

@@ -0,0 +1,39 @@
+name: Publish to BCR
+
+on:
+  # Run the publish workflow after a successful release
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+  # In case of problems, let release engineers retry by manually dispatching
+  # the workflow from the GitHub UI
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: 'Tag name to publish (e.g., v25.2.10)'
+        required: true
+        type: string
+
+jobs:
+  publish:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.0.0
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
+      # This should be set to your fork of bazel-central-registry
+      registry_fork: google/bazel-central-registry
+      # Enable attestation support
+      attest: true
+      # Open the pull request as a draft
+      draft: true
+    permissions:
+      contents: write
+      # Necessary for attestation
+      id-token: write
+      # Necessary for attestation
+      attestations: write
+    secrets:
+      # Necessary to push to the BCR fork, and to open a pull request against a registry
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}

.github/workflows/release.yml

@@ -150,3 +150,18 @@ jobs:
         with:
           path: ./rust/flexbuffers
           registry-token: ${{ secrets.CARGO_TOKEN }}
+
+  publish-bcr:
+    name: Publish to BCR
+    # Run after all other publish jobs succeed to ensure we only publish to BCR
+    # if all package publications were successful
+    needs: [publish-npm, publish-pypi, publish-nuget, publish-maven, publish-maven-kotlin, publish-crates]
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ github.event.release.tag_name }}
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    secrets:
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}