Feature/tools versioning

.bcr/tools/metadata.template.json

@@ -0,0 +1,28 @@
+{
+  "homepage": "https://github.com/bazel-contrib/supply-chain",
+  "maintainers": [
+        {
+            "email": "[email protected]",
+            "github": "aiuto",
+            "name": "Tony Aiuto"
+        },
+        {
+            "email": "[email protected]",
+            "github": "TheGrizzlyDev",
+            "name": "Antonio Di Stefano"
+        },
+        {
+            "email": "[email protected]",
+            "github": "fweikert",
+            "name": "Florian Weikert"
+        },
+        {
+            "email": "[email protected]",
+            "github": "Yannic",
+            "name": "Yannic Bonenberger"
+        }
+  ],
+  "repository": ["github:bazel-contrib/supply-chain"],
+  "versions": [],
+  "yanked_versions": {}
+}

.bcr/tools/presubmit.yml

@@ -0,0 +1,17 @@
+matrix:
+  platform:
+  - debian10
+  - ubuntu2004
+  - macos
+  - windows
+  bazel
+  - 8.x
+  - 7.x
+  - 6.x
+tasks:
+  verify_targets:
+    name: Verify build targets
+    platform: ${{ platform }}
+    bazel: ${{ bazel }}
+    build_targets:
+    - '@supply_chain_tools//...'

.bcr/tools/source.template.json

@@ -0,0 +1,5 @@
+{
+  "integrity": "**leave this alone**",
+  "strip_prefix": "{REPO}-{VERSION}/tools",
+  "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{TAG}.tar.gz"
+}

.github/workflows/tools_release.yml

@@ -0,0 +1,108 @@
+name: "Create supply_chain_tools release"
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+        type: "string"
+        description: "Version for supply_chain_tools release (e.g., 1.0.0)"
+
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+
+jobs:
+  ci:
+    name: "CI"
+    uses: "./.github/workflows/ci.yml"
+
+  create_tools_tag:
+    name: "Create supply_chain_tools tag"
+    runs-on:
+      - "ubuntu-latest"
+    needs:
+      - "ci"
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: "Create supply_chain_tools tag"
+        id: "tag"
+        env:
+          VERSION: "${{ inputs.version }}"
+          GIT_AUTHOR_NAME: "${{ github.actor }}"
+          GIT_AUTHOR_EMAIL: "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
+          GIT_COMMITTER_NAME: "${{ github.actor }}"
+          GIT_COMMITTER_EMAIL: "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
+        run: |
+          # 1. Download `buildozer`
+          curl -o "${RUNNER_TEMP}/buildozer" -L "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildozer-linux-amd64"
+          chmod +x "${RUNNER_TEMP}/buildozer"
+
+          # 2. Update supply_chain_tools MODULE.bazel version
+          "${RUNNER_TEMP}/buildozer" "set version ${VERSION}" "//tools/MODULE.bazel:supply_chain_tools"
+          git add "tools/MODULE.bazel"
+          git commit -m "Release supply_chain_tools v${VERSION}"
+
+          # 3. Push supply_chain_tools release tag
+          git tag "supply_chain_tools-v${VERSION}" "HEAD"
+          git push origin "supply_chain_tools-v${VERSION}"
+
+      - name: "Generate release artifacts"
+        run: |
+          ./.github/workflows/tools_release_prep.sh "supply_chain_tools-v${{ inputs.version }}" > release_notes.md
+
+      - name: "Upload release artifacts"
+        uses: actions/upload-artifact@v4
+        with:
+          name: supply_chain_tools-release-artifacts
+          path: |
+            supply-chain-tools-*.tar.gz
+            release_notes.md
+
+  release:
+    name: "Create GitHub release for supply_chain_tools"
+    needs:
+      - "create_tools_tag"
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: "Download artifacts"
+        uses: actions/download-artifact@v4
+        with:
+          name: supply_chain_tools-release-artifacts
+
+      - name: "Create GitHub Release"
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: "supply_chain_tools-v${{ inputs.version }}"
+          name: "supply_chain_tools v${{ inputs.version }}"
+          body_path: release_notes.md
+          files: |
+            supply-chain-tools-*.tar.gz
+          draft: false
+          prerelease: false
+
+  publish_to_bcr:
+    name: "Publish supply_chain_tools to BCR"
+    needs:
+      - "release"
+
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+
+    uses: "bazel-contrib/publish-to-bcr/.github/workflows/[email protected]"
+    with:
+      tag_name: "supply_chain_tools-v${{ inputs.version }}"
+      registry_fork: "bazel-contrib/bazel-central-registry"
+      draft: false
+    secrets:
+      publish_token: "${{ secrets.BCR_PUBLISH_TOKEN }}"

.github/workflows/tools_release_prep.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+
+# Passed as argument when invoking the script.
+TAG="${1}"
+
+# The prefix is chosen to match what GitHub generates for source archives
+# This guarantees that users can easily switch from a released artifact to a source archive
+# with minimal differences in their code (e.g. strip_prefix remains the same)
+PREFIX="supply-chain-tools-${TAG:1}"
+ARCHIVE="supply-chain-tools-$TAG.tar.gz"
+
+# Create a temporary directory for the tools content
+TEMP_DIR=$(mktemp -d)
+trap "rm -rf $TEMP_DIR" EXIT
+
+# Copy the tools directory to the temporary location with the correct prefix
+mkdir -p "$TEMP_DIR/$PREFIX"
+cp -r tools/* "$TEMP_DIR/$PREFIX/"
+
+# Create the archive from the temporary directory
+cd "$TEMP_DIR"
+tar -czf "$OLDPWD/$ARCHIVE" "$PREFIX"
+cd "$OLDPWD"
+
+SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
+
+cat << EOF
+## Using Bzlmod with Bazel 6 or greater
+
+1. (Bazel 6 only) Enable with \`common --enable_bzlmod\` in \`.bazelrc\`.
+2. Add to your \`MODULE.bazel\` file:
+
+\`\`\`starlark
+bazel_dep(name = "supply_chain_tools", version = "${TAG:1}")
+\`\`\`
+
+## Using WORKSPACE
+
+Paste this snippet into your \`WORKSPACE.bazel\` file:
+
+\`\`\`starlark
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+http_archive(
+    name = "supply_chain_tools",
+    sha256 = "${SHA}",
+    strip_prefix = "${PREFIX}",
+    url = "https://github.com/bazel-contrib/supply-chain/releases/download/${TAG}/${ARCHIVE}",
+)
+\`\`\`
+EOF