chore: enable immutable releases (#42)

Author: kormide

.github/workflows/publish.yaml

@@ -21,7 +21,7 @@ on:
         type: string
 jobs:
   publish:
-    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.1.0
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.2.0
     with:
       tag_name: ${{ inputs.tag_name }}
       # GitHub repository which is a fork of the upstream where the Pull Request will be opened.

.github/workflows/release.yaml

@@ -24,6 +24,8 @@ jobs:
     with:
       release_files: diff.bzl-*.tar.gz
       prerelease: false
+      draft: true
+      attest: true
       tag_name: ${{ inputs.tag_name || github.ref_name }}
   publish:
     needs: release
@@ -32,3 +34,8 @@ jobs:
       tag_name: ${{ inputs.tag_name || github.ref_name }}
     secrets:
       publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
+  finalize:
+    # Publish the draft release
+    uses: softprops/action-gh-release@v2
+    with:
+      tag_name: ${{ inputs.tag_name || github.ref_name }}