chore: enable immutable releases (#1822)

* chore: enable immutable releases

* Potential fix for code scanning alert no. 2: Workflow does not contain permissions

Note: Future AI-generated commits are _not_ welcome.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

---------

Co-authored-by: Alex Eagle <alex@aspect.dev>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: alexeagle

.github/workflows/publish-to-bcr.yml

@@ -24,7 +24,7 @@ on:
 
 jobs:
   publish-to-bcr:
-    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.0.0
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.2.0
     with:
       tag_name: ${{ inputs.tag_name }}
       # bazelbuild/bazel-central-registry fork used to open a pull request.
@@ -38,3 +38,13 @@ jobs:
     secrets:
       # Necessary to push to the BCR fork and open a pull request.
       publish_token: ${{ secrets.bcr_publish_token }}
+  finalize:
+    permissions:
+      contents: write
+    needs: publish-to-bcr
+    runs-on: ubuntu-latest
+    steps:
+      - run: gh release edit "$TAG" --draft=false --repo "$GITHUB_REPOSITORY"
+        env:
+          TAG: ${{ inputs.tag_name }}
+          GH_TOKEN: ${{ github.token }}

.github/workflows/release.yml

@@ -27,10 +27,11 @@ permissions:
 
 jobs:
   release:
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.3
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.4.0
     with:
       bazel_test_command: "bazel test //src/... //test/... //third_party/..."
       prerelease: false
+      draft: true
       release_files: rules_scala-*.tar.gz
       tag_name: ${{ inputs.tag_name || github.ref_name }}