fix(bazel): publish stable BCR release archives

.github/workflows/bcr.yml

@@ -58,6 +58,9 @@ jobs:
             const crypto = require("node:crypto");
             const root = process.argv[1];
             const source = JSON.parse(fs.readFileSync(`${root}/source.json`));
+            if (!source.url.includes("/releases/download/")) {
+              throw new Error(`BCR source URL is not a stable release asset: ${source.url}`);
+            }
             for (const [name, expected] of Object.entries(source.overlay)) {
               const content = fs.readFileSync(`${root}/overlay/${name}`);
               const actual = `sha256-${crypto.createHash("sha256").update(content).digest("base64")}`;

.github/workflows/cli-release.yml

@@ -157,6 +157,9 @@ jobs:
     if: ${{ (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'codescythe_cli_v')) || (github.event_name == 'workflow_dispatch' && inputs.dry_run == false && startsWith(github.ref_name, 'codescythe_cli_v')) }}
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
       - name: Download release artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
@@ -175,6 +178,19 @@ jobs:
           rm -rf release
           mv release-assets release
 
+      - name: Create deterministic source archive
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name || github.ref_name }}
+        run: |
+          set -euo pipefail
+
+          version="${RELEASE_TAG#codescythe_cli_v}"
+          git archive \
+            --format=tar.gz \
+            --prefix="codescythe-$version/" \
+            --output="release/codescythe-$version.tar.gz" \
+            HEAD
+
       - name: Generate checksums
         run: |
           set -euo pipefail
@@ -199,6 +215,7 @@ jobs:
             release/codescythe-darwin-arm64 \
             release/codescythe-linux-amd64 \
             release/codescythe-linux-arm64 \
+            "release/codescythe-${RELEASE_TAG#codescythe_cli_v}.tar.gz" \
             release/checksums.txt \
             --clobber
 

.github/workflows/publish-bcr.yml

@@ -103,11 +103,6 @@ jobs:
               -f base=main \
               -f body='Publish the Codescythe binary toolchain overlay.' \
               --jq .html_url)"
-            pr_number="${pr_url##*/}"
-            gh api \
-              --method POST \
-              "repos/bazelbuild/bazel-central-registry/issues/$pr_number/comments" \
-              -f body='@bazel-io skip_check unstable_url'
           fi
 
           echo "$pr_url" >> "$GITHUB_STEP_SUMMARY"

bcr/modules/codescythe/0.10.1/source.json

@@ -1,7 +1,7 @@
 {
-  "url": "https://github.com/perplexityai/codescythe/archive/refs/tags/codescythe_cli_v0.10.1.tar.gz",
-  "integrity": "sha256-LeLiBjtSWW/tQVXOAa6eDQI4MmBolxIYtc0ukRCW5lQ=",
-  "strip_prefix": "codescythe-codescythe_cli_v0.10.1",
+  "url": "https://github.com/perplexityai/codescythe/releases/download/codescythe_cli_v0.10.1/codescythe-0.10.1.tar.gz",
+  "integrity": "sha256-mKQPdgSfVckSHFgTq4dbDkhMi7Mw8CXhuDW65XS5Vdk=",
+  "strip_prefix": "codescythe-0.10.1",
   "overlay": {
     "BUILD.bazel": "sha256-Xvy9R+IqlTF1S7QTvE0DEDgB9LUSrQJiFMVGlo5Ymns=",
     "MODULE.bazel": "sha256-DF6Qg9DJ35CrEQuQU84KFDdiUf7Bb294pRgKENiX0Uk=",