From 23885aaf72773507cb342f148a4eba78c2e34959 Mon Sep 17 00:00:00 2001
From: tonyaiuto <tony@aiuto.dev>
Date: Tue, 17 Feb 2026 23:01:43 -0400
Subject: [PATCH 1/3] Add release workflow for the providers submodule

- generalizable to more modules.
- creates the tarball and relnotes as part of the distro package.

Future work:

- figure out something for BCR releases.
  - Hope for: https://github.com/bazel-contrib/publish-to-bcr/issues/368
  - more pragmatic solution might be to have a shell script around the bcr add-module script
- generate git changelog on a per-subdir basis
- allow better customization of release notes documentation link
---
 .github/workflows/checks.sh          |  8 ++++
 .github/workflows/release_module.yml | 69 ++++++++++++++++++++++++++++
 .github/workflows/release_prep.sh    | 37 +++++++++++----
 distro/BUILD                         | 36 +++++++++++++++
 providers/BUILD                      |  6 ++-
 providers/version.bzl                |  1 +
 6 files changed, 148 insertions(+), 9 deletions(-)
 create mode 100644 .github/workflows/release_module.yml
 create mode 100644 providers/version.bzl

diff --git a/.github/workflows/checks.sh b/.github/workflows/checks.sh
index 0696c548..52f4929e 100755
--- a/.github/workflows/checks.sh
+++ b/.github/workflows/checks.sh
@@ -2,6 +2,14 @@
 
 set -o errexit -o nounset -o pipefail
 
+# First, check the core providers basically OK.
+bazel_cmd=(bazel query :all)
+echo "${bazel_cmd[@]}"
+( cd providers ; "${bazel_cmd[@]}" )
+exit_code="$?"
+if [ "${exit_code}" -ne 0 ] ; then
+    exit "${exit_code}"
+fi
 
 FILTERS=()
 if [[ -n "${TEST_FILTER:-}" ]] ; then
diff --git a/.github/workflows/release_module.yml b/.github/workflows/release_module.yml
new file mode 100644
index 00000000..99a9c0f7
--- /dev/null
+++ b/.github/workflows/release_module.yml
@@ -0,0 +1,69 @@
+name: "Create a submodule release"
+
+on:
+  workflow_dispatch:
+    inputs:
+      subdir:
+        required: true
+        type: string
+        description: "The subdir within rules_pkg"
+        default: "providers"
+      version:
+        required: true
+        type: string
+        description: "Version #"
+
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+
+jobs:
+  tests:
+    name: "Release Tests"
+    uses: "./.github/workflows/checks.yml"
+
+  create_tag:
+    name: "Create tag"
+    runs-on:
+      - "ubuntu-latest"
+    needs:
+      - "tests"
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: "Create tag"
+        id: "tag"
+        env:
+          SUBDIR: "${{ inputs.subdir }}"
+          VERSION: "${{ inputs.version }}"
+          MODULE: "rules_pkg_${SUBDIR}"
+
+          GIT_AUTHOR_NAME: "${{ github.actor }}"
+          GIT_AUTHOR_EMAIL: "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
+          GIT_COMMITTER_NAME: "${{ github.actor }}"
+          GIT_COMMITTER_EMAIL: "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
+        run: |
+          # Download `buildozer`
+          #
+          curl -o "${RUNNER_TEMP}/buildozer" -L "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildozer-linux-amd64"
+          "${RUNNER_TEMP}/buildozer" "set version ${VERSION}" "//${SUBDIR}/MODULE.bazel:${MODULE}" || true
+          git add "${MODULE}/MODULE.bazel"
+          git commit -m "Release `${MODULE}-${VERSION}`"
+
+          # 3. Push release tag.
+          git tag "${MODULE}-${VERSION}" "HEAD"
+          git push origin "${MODULE}-${VERSION}"
+
+  release:
+    name: "Create GitHub release"
+    needs:
+      - "create_tag"
+
+    uses: "bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.4"
+    with:
+      # This will run release_prep.sh to do the dirty work.
+      # TODO: https://github.com/bazelbuild/rules_pkg/issues/1031
+      release_files: "bazel-bin/distro/rules_pkg_${{ inputs.subdir }}-*.tgz"
+      tag_name: "rule_pkg_${{ inputs.subdir }}-${{ inputs.version }}"
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
index 98e44933..0aa194d1 100755
--- a/.github/workflows/release_prep.sh
+++ b/.github/workflows/release_prep.sh
@@ -5,11 +5,32 @@ set -o errexit -o nounset -o pipefail
 # Passed as argument when invoking the script.
 TAG="${1}"
 
-# The prefix is chosen to match what GitHub generates for source archives
-# This guarantees that users can easily switch from a released artifact to a source archive
-# with minimal differences in their code (e.g. strip_prefix remains the same)
-PREFIX="rules_pkg--${TAG:1}"
-ARCHIVE="rules_pkg-$TAG.tar.gz"
-
-bazel build distro:relnotes
-cat bazel-bin/distro/relnotes.txt
+# Get back to the root
+cd ../../
+
+case "${TAG}" in
+  [0-9]* )
+    # This is the rules_pkg main release.
+    VERSION="${TAG:1}"
+    PREFIX="rules_pkg-${TAG:1}"
+    ARCHIVE="rules_pkg-$TAG.tar.gz"
+
+    bazel build //distro:relnotes
+    cat bazel-bin/distro/relnotes.txt
+    exit 0
+    ;;
+  * )
+    ;;
+esac
+
+# If we fall to here, we are in a sub-module release
+
+# TODO: We could pass the version as a build time flag. I don't want
+# to do that yet, because I want to discuss this with other rule
+# authors.
+# VERSION=$(echo "$TAG" | sed -e 's/^.*-//')
+MODULE=$(echo "$TAG" | sed -e 's/-[0-9]*.*$//')
+
+bazel build //distro:${MODULE}_relnotes
+cp bazel-bin/distro/${MODULE}*tgz .
+cat bazel-bin/distro/${MODULE}_relnotes.txt
diff --git a/distro/BUILD b/distro/BUILD
index d105f560..dd431f42 100644
--- a/distro/BUILD
+++ b/distro/BUILD
@@ -14,9 +14,11 @@
 
 load("@rules_python//python:defs.bzl", "py_test")
 load("//:version.bzl", "version")
+load("//pkg:mappings.bzl", "pkg_files", "strip_prefix")
 load("//pkg:tar.bzl", "pkg_tar")
 load("//pkg/releasing:defs.bzl", "print_rel_notes")
 load("//pkg/releasing:git.bzl", "git_changelog")
+load("//providers:version.bzl", providers_version = "version")
 
 package(
     default_applicable_licenses = ["//:license"],
@@ -117,3 +119,37 @@ genrule(
     outs = ["release_version.py"],
     cmd = "echo RELEASE_VERSION = \\'%s\\' >$@" % version,
 )
+
+#
+# Submodules
+#
+pkg_files(
+    name = "rules_pkg_providers_files",
+    srcs = [
+        "//providers:all_srcs",
+    ],
+    strip_prefix = strip_prefix.from_root("providers"),
+)
+
+pkg_tar(
+    name = "rules_pkg_providers_tar",
+    srcs = [
+        ":rules_pkg_providers_files",
+    ],
+    out = "rules_pkg_providers-%s.tgz" % providers_version,
+    extension = "tgz",
+    # It is all source code, so make it read-only.
+    mode = "0444",
+    # Make it owned by root so it does not have the uid of the CI robot.
+    owner = "0.0",
+    package_dir = ".",
+)
+
+print_rel_notes(
+    name = "rules_pkg_providers_relnotes",
+    outs = ["rules_pkg_providers_relnotes.txt"],
+    artifact_name = "rules_pkg_providers-%s.tgz" % providers_version,
+    org = "bazelbuild",
+    repo = "rules_pkg_providers",
+    version = providers_version,
+)
diff --git a/providers/BUILD b/providers/BUILD
index 5a1a4887..b375a817 100644
--- a/providers/BUILD
+++ b/providers/BUILD
@@ -29,5 +29,9 @@ license(
 
 filegroup(
     name = "all_srcs",
-    srcs = glob(["**"]),
+    srcs = [
+        "BUILD",
+        "LICENSE",
+        "MODULE.bazel",
+    ] + glob(["**/*.bzl"]),
 )
diff --git a/providers/version.bzl b/providers/version.bzl
new file mode 100644
index 00000000..11a716ec
--- /dev/null
+++ b/providers/version.bzl
@@ -0,0 +1 @@
+version = "1.0.0"

From abb936feecc5de5a400f9216d753f2a147b69888 Mon Sep 17 00:00:00 2001
From: tonyaiuto <tony@aiuto.dev>
Date: Sun, 22 Feb 2026 18:23:20 -0500
Subject: [PATCH 2/3] linty

---
 providers/version.bzl | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/providers/version.bzl b/providers/version.bzl
index 11a716ec..ead02a6e 100644
--- a/providers/version.bzl
+++ b/providers/version.bzl
@@ -1 +1,3 @@
+"""The version of rules_pkg_providers."""
+
 version = "1.0.0"

From b3b1ad91b2a5559a6aeaaef28faf8979a37e5259 Mon Sep 17 00:00:00 2001
From: tonyaiuto <tony@aiuto.dev>
Date: Mon, 2 Mar 2026 21:53:47 -0500
Subject: [PATCH 3/3] make it cleaner

---
 .github/workflows/checks.sh | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/.github/workflows/checks.sh b/.github/workflows/checks.sh
index 52f4929e..b1845e32 100755
--- a/.github/workflows/checks.sh
+++ b/.github/workflows/checks.sh
@@ -6,10 +6,6 @@ set -o errexit -o nounset -o pipefail
 bazel_cmd=(bazel query :all)
 echo "${bazel_cmd[@]}"
 ( cd providers ; "${bazel_cmd[@]}" )
-exit_code="$?"
-if [ "${exit_code}" -ne 0 ] ; then
-    exit "${exit_code}"
-fi
 
 FILTERS=()
 if [[ -n "${TEST_FILTER:-}" ]] ; then
@@ -22,18 +18,9 @@ bazel_cmd=(bazel test --build_tests_only "${FILTERS[@]}" -- ${TESTS} //examples/
 
 echo "${bazel_cmd[@]}"
 "${bazel_cmd[@]}"
-exit_code="$?"
-if [ "${exit_code}" -ne 0 ] ; then
-    exit "${exit_code}"
-fi
 
 if [ -n "${BUILD_DISTRO:-}" ] ; then
     bazel build  //distro:distro
-    exit_code="$?"
-    if [ "${exit_code}" -ne 0 ] ; then
-        echo "Could not build //distro:distro"
-        exit "${exit_code}"
-    fi
 fi
 
 exit "${exit_code}"