Finalize release after publish to BCR

Author: alexeagle

.github/workflows/publish.yaml

@@ -19,18 +19,28 @@ on:
         description: a tag pointing to the commit being published
         required: true
         type: string
+
+permissions:
+  attestations: write
+  contents: write
+  id-token: write
 jobs:
   publish:
     uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.1.0
     with:
       tag_name: ${{ inputs.tag_name }}
       # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
       registry_fork: bazel-contrib/bazel-central-registry
-      draft: false
-    permissions:
-      attestations: write
-      contents: write
-      id-token: write
+      draft: false # The PR can be non-draft since it's opened by bazel-contrib-bot.
     secrets:
       # Necessary to push to the BCR fork, and to open a pull request against a registry
       publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
+  # The publish.yaml re-usable workflow mutates the release, so it has been a draft until now.
+  # This job will update the release to be non-draft.
+  update_release:
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+      - run: gh release edit ${{ inputs.tag_name }} --draft=false
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}