From cd49a1cab10a1953c6228063bbb12948307ba44c Mon Sep 17 00:00:00 2001
From: Ignas Anikevicius <240938+aignas@users.noreply.github.com>
Date: Thu, 16 Oct 2025 23:07:10 +0900
Subject: [PATCH 1/5] fix(doc): fix the release notes for the starlarkification
 of the flags (#3361)

It seems that the changelog got merged for `1.7.0`, but the
`VERSION_NEXT_FEATURE` got added to the docs instead of `1.7.0`. This is
fixing
that so that we can merge/cherry-pick again to the release branch.
---
 docs/api/rules_python/python/config_settings/index.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/api/rules_python/python/config_settings/index.md b/docs/api/rules_python/python/config_settings/index.md
index 78a74c3f37..3092326d6f 100644
--- a/docs/api/rules_python/python/config_settings/index.md
+++ b/docs/api/rules_python/python/config_settings/index.md
@@ -41,7 +41,7 @@ Values:
 
 This flag replaces the Bazel builtin `--build_python_zip` flag.
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 1.7.0
 :::
 ::::
 
@@ -62,7 +62,7 @@ Values;
 This flag replaces the Bazel builtin
 `--experimental_python_import_all_repositories` flag.
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 1.7.0
 :::
 ::::
 
@@ -75,11 +75,11 @@ be removed.
 
 This flag replaces the Bazel builtin `--python_path` flag.
 
-:::{deprecated} VERSION_NEXT_FEATURE
+:::{deprecated} 1.7.0
 Use toolchains instead.
 :::
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 1.7.0
 :::
 ::::
 
@@ -111,7 +111,7 @@ Values:
 This flag replaces the Bazel builtin
 `--incompatible_default_to_explicit_init_py` flag.
 
-:::{versionadded} VERSION_NEXT_FEATURE
+:::{versionadded} 1.7.0
 :::
 ::::
 

From b9ec06fc498f8b01a9779120100cc009a2c83b33 Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Thu, 16 Oct 2025 16:16:49 -0700
Subject: [PATCH 2/5] chore: switch to use publish-to-bcr workflow (#3359)

The GitHub App is deprecated, so switch to the more modern workflow.

This will also allow us to eventually use attestations.

Along the way...

* Split up the release workflow into some different sub-jobs
* Run PyPI upload last, as its the most irrevocable step of the process.
---
 .github/workflows/publish.yml | 35 +++++++++++++++++++++++
 .github/workflows/release.yml | 52 +++++++++++++++++++++++------------
 2 files changed, 69 insertions(+), 18 deletions(-)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000000..f03e02168f
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,35 @@
+# See https://github.com/bazel-contrib/publish-to-bcr
+name: Publish to BCR
+
+on:
+  # Run the publish workflow after a successful release
+  # Can be triggered from the release.yaml workflow
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      BCR_PUBLISH_TOKEN:
+        required: true
+  # In case of problems, let release engineers retry by manually dispatching
+  # the workflow from the GitHub UI
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+
+jobs:
+  publish:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.0.0
+    with:
+      draft: false
+      tag_name: ${{ inputs.tag_name }}
+      # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
+      registry_fork: bazel-contrib/bazel-central-registry
+      attest: false
+    permissions:
+      contents: write
+    secrets:
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7a25c6eca0..0ed4992ccd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,21 +35,37 @@ jobs:
         uses: actions/checkout@v5
       - name: Create release archive and notes
         run: .github/workflows/create_archive_and_notes.sh
-      - name: Publish wheel dist
-        if: github.event_name == 'push' || github.event.inputs.publish_to_pypi
-        env:
-          # This special value tells pypi that the user identity is supplied within the token
-          TWINE_USERNAME: __token__
-          # Note, the PYPI_API_TOKEN is for the rules-python pypi user, added by @rickylev on
-          # https://github.com/bazel-contrib/rules_python/settings/secrets/actions
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-        run: bazel run --stamp --embed_label=${{ github.ref_name }} //python/runfiles:wheel.publish
-      - name: Release
-        uses: softprops/action-gh-release@v2
-        with:
-          # Use GH feature to populate the changelog automatically
-          generate_release_notes: true
-          body_path: release_notes.txt
-          prerelease: ${{ contains(github.ref, '-rc') }}
-          fail_on_unmatched_files: true
-          files: rules_python-*.tar.gz
+
+  release:
+    name: Release
+    uses: softprops/action-gh-release@v2
+    with:
+      # Use GH feature to populate the changelog automatically
+      generate_release_notes: true
+      body_path: release_notes.txt
+      prerelease: ${{ contains(github.ref, '-rc') }}
+      fail_on_unmatched_files: true
+      files: rules_python-*.tar.gz
+
+  publish_bcr:
+    name: Publish to BCR
+    needs: release
+    uses: .github/workflows/publish.yaml
+    with:
+      tag_name: ${{ github.ref_name }}
+    secrets:
+      BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}
+
+  publish_pypi:
+    # We just want publish_pypi last, since once uploaded, it can't be changed.
+    name: Publish runfiles to PyPI
+    needs: publish_bcr
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' || github.event.inputs.publish_to_pypi
+    env:
+      # This special value tells pypi that the user identity is supplied within the token
+      TWINE_USERNAME: __token__
+      # Note, the PYPI_API_TOKEN is for the rules-python pypi user, added by @rickylev on
+      # https://github.com/bazel-contrib/rules_python/settings/secrets/actions
+      TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+    run: bazel run --stamp --embed_label=${{ github.ref_name }} //python/runfiles:wheel.publish

From e487b6dddd2c3b233f94e4a343d9cf0cb32d60ec Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Thu, 16 Oct 2025 20:49:21 -0700
Subject: [PATCH 3/5] chore: fix create_archive_and_notes to ignore release
 tool markers (#3355)

The create_archive_and_notes.sh script is incorrectly detecting the
version markers
in the tool meant to rewrite them. To fix, ignore those files.
---
 .github/workflows/create_archive_and_notes.sh | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/create_archive_and_notes.sh b/.github/workflows/create_archive_and_notes.sh
index a21585f866..b53c49aa09 100755
--- a/.github/workflows/create_archive_and_notes.sh
+++ b/.github/workflows/create_archive_and_notes.sh
@@ -13,12 +13,22 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-set -o errexit -o nounset -o pipefail
+set -o nounset
+set -o pipefail
+set -o errexit
 
+set -x
 # Exclude dot directories, specifically, this file so that we don't
 # find the substring we're looking for in our own file.
 # Exclude CONTRIBUTING.md, RELEASING.md because they document how to use these strings.
-if grep --exclude=CONTRIBUTING.md --exclude=RELEASING.md --exclude-dir=.* VERSION_NEXT_ -r; then
+grep --exclude=CONTRIBUTING.md \
+  --exclude=RELEASING.md \
+  --exclude=release.py \
+  --exclude=release_test.py \
+  --exclude-dir=.* \
+  VERSION_NEXT_ -r || grep_exit_code=$?
+
+if [[ $grep_exit_code -eq 0 ]]; then
   echo
   echo "Found VERSION_NEXT markers indicating version needs to be specified"
   exit 1

From f92ad7136ff411755ec8d8361af8263fd8efe6f2 Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Fri, 17 Oct 2025 16:09:48 -0700
Subject: [PATCH 4/5] chore: make gazelle bcr tests compatible with bcr
 presubmit environment (#3365)

BCR recently changed how it extracts archives in its presubmits: instead
of extracting
the whole archive, only the specified portion (`gazelle/` in this case)
is extracted.
This broke the gazelle tests because they reference files above the
gazelle directory.

To fix, move the module it runs as a test under the gazelle directory.

Because the test module also refers to rules_python, which is above the
gazelle
directory, the bcr presubmit has disable that override using
`--override_module`.
This means, going forward, the gazelle module, when bcr tests it, will
use the
version in the MODULE file (rather than the vendored copy).

Fixes https://github.com/bazel-contrib/rules_python/issues/3364
---
 .bazelci/presubmit.yml                        | 24 +++++++++----------
 .bazelignore                                  |  4 ++++
 .bazelrc                                      |  3 +++
 .bcr/gazelle/presubmit.yml                    |  4 +++-
 .../other_module/MODULE.bazel                 |  5 ----
 gazelle/.bazelignore                          |  8 +++++++
 gazelle/.bazelrc                              |  3 +++
 .../bzlmod_build_file_generation/.bazelignore |  0
 .../bzlmod_build_file_generation/.bazelrc     |  0
 .../bzlmod_build_file_generation/.gitignore   |  0
 .../bzlmod_build_file_generation/BUILD.bazel  |  0
 .../bzlmod_build_file_generation/MODULE.bazel | 12 ++++++----
 .../bzlmod_build_file_generation/README.md    |  0
 .../bzlmod_build_file_generation/WORKSPACE    |  0
 .../bzlmod_build_file_generation/__main__.py  |  0
 .../bzlmod_build_file_generation/__test__.py  |  0
 .../gazelle_python.yaml                       |  0
 .../gazelle_python_with_types.yaml            |  0
 .../bzlmod_build_file_generation/lib.py       |  0
 .../other_module/MODULE.bazel                 |  7 ++++++
 .../other_module/WORKSPACE                    |  0
 .../other_module/other_module/pkg/BUILD.bazel |  0
 .../other_module/pkg/data/data.txt            |  0
 .../other_module/other_module/pkg/lib.py      |  0
 .../requirements.in                           |  0
 .../requirements_lock.txt                     |  0
 .../requirements_windows.txt                  |  0
 .../runfiles/BUILD.bazel                      |  0
 .../runfiles/data/data.txt                    |  0
 .../runfiles/runfiles_test.py                 |  0
 30 files changed, 47 insertions(+), 23 deletions(-)
 delete mode 100644 examples/bzlmod_build_file_generation/other_module/MODULE.bazel
 create mode 100644 gazelle/.bazelignore
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/.bazelignore (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/.bazelrc (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/.gitignore (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/BUILD.bazel (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/MODULE.bazel (91%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/README.md (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/WORKSPACE (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/__main__.py (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/__test__.py (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/gazelle_python.yaml (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/gazelle_python_with_types.yaml (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/lib.py (100%)
 create mode 100644 gazelle/examples/bzlmod_build_file_generation/other_module/MODULE.bazel
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/other_module/WORKSPACE (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/other_module/other_module/pkg/BUILD.bazel (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/other_module/other_module/pkg/data/data.txt (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/other_module/other_module/pkg/lib.py (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/requirements.in (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/requirements_lock.txt (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/requirements_windows.txt (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/runfiles/BUILD.bazel (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/runfiles/data/data.txt (100%)
 rename {examples => gazelle/examples}/bzlmod_build_file_generation/runfiles/runfiles_test.py (100%)

diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index 119ad498b0..6ed93b083d 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -329,20 +329,20 @@ tasks:
     <<: *minimum_supported_version
     <<: *reusable_build_test_all
     <<: *coverage_targets_example_bzlmod_build_file_generation
-    name: "examples/bzlmod_build_file_generation: Ubuntu, minimum Bazel"
-    working_directory: examples/bzlmod_build_file_generation
+    name: "gazelle/examples/bzlmod_build_file_generation: Ubuntu, minimum Bazel"
+    working_directory: gazelle/examples/bzlmod_build_file_generation
     platform: ubuntu2204
     bazel: 7.x
   integration_test_bzlmod_generation_build_files_ubuntu:
     <<: *reusable_build_test_all
     <<: *coverage_targets_example_bzlmod_build_file_generation
-    name: "examples/bzlmod_build_file_generation: Ubuntu"
-    working_directory: examples/bzlmod_build_file_generation
+    name: "gazelle/examples/bzlmod_build_file_generation: Ubuntu"
+    working_directory: gazelle/examples/bzlmod_build_file_generation
     platform: ubuntu2204
   integration_test_bzlmod_generation_build_files_ubuntu_run:
     <<: *reusable_build_test_all
-    name: "examples/bzlmod_build_file_generation: Ubuntu, Gazelle and pip"
-    working_directory: examples/bzlmod_build_file_generation
+    name: "gazelle/examples/bzlmod_build_file_generation: Ubuntu, Gazelle and pip"
+    working_directory: gazelle/examples/bzlmod_build_file_generation
     platform: ubuntu2204
     shell_commands:
     - "bazel run //:gazelle_python_manifest.update"
@@ -350,20 +350,20 @@ tasks:
   integration_test_bzlmod_build_file_generation_debian:
     <<: *reusable_build_test_all
     <<: *coverage_targets_example_bzlmod_build_file_generation
-    name: "examples/bzlmod_build_file_generation: Debian"
-    working_directory: examples/bzlmod_build_file_generation
+    name: "gazelle/examples/bzlmod_build_file_generation: Debian"
+    working_directory: gazelle/examples/bzlmod_build_file_generation
     platform: debian11
   integration_test_bzlmod_build_file_generation_macos:
     <<: *reusable_build_test_all
     <<: *coverage_targets_example_bzlmod_build_file_generation
-    name: "examples/bzlmod_build_file_generation: MacOS"
-    working_directory: examples/bzlmod_build_file_generation
+    name: "gazelle/examples/bzlmod_build_file_generation: MacOS"
+    working_directory: gazelle/examples/bzlmod_build_file_generation
     platform: macos
   integration_test_bzlmod_build_file_generation_windows:
     <<: *reusable_build_test_all
     # coverage is not supported on Windows
-    name: "examples/bzlmod_build_file_generation: Windows"
-    working_directory: examples/bzlmod_build_file_generation
+    name: "gazelle/examples/bzlmod_build_file_generation: Windows"
+    working_directory: gazelle/examples/bzlmod_build_file_generation
     platform: windows
 
   integration_test_multi_python_versions_ubuntu_workspace:
diff --git a/.bazelignore b/.bazelignore
index fb999097f5..dd58b79e3c 100644
--- a/.bazelignore
+++ b/.bazelignore
@@ -26,6 +26,10 @@ examples/pip_parse_vendored/bazel-pip_parse_vendored
 examples/pip_repository_annotations/bazel-pip_repository_annotations
 examples/py_proto_library/bazel-py_proto_library
 gazelle/bazel-gazelle
+gazelle/examples/bzlmod_build_file_generation/bazel-bin
+gazelle/examples/bzlmod_build_file_generation/bazel-bzlmod_build_file_generation
+gazelle/examples/bzlmod_build_file_generation/bazel-out
+gazelle/examples/bzlmod_build_file_generation/bazel-testlog
 tests/integration/compile_pip_requirements/bazel-compile_pip_requirements
 tests/integration/ignore_root_user_error/bazel-ignore_root_user_error
 tests/integration/local_toolchains/bazel-local_toolchains
diff --git a/.bazelrc b/.bazelrc
index 801b963ad5..b5c9c7c1e2 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -9,6 +9,9 @@ query --deleted_packages=examples/build_file_generation,examples/build_file_gene
 
 test --test_output=errors
 
+common --deleted_packages=gazelle/examples/bzlmod_build_file_generation
+common --deleted_packages=gazelle/examples/bzlmod_build_file_generation/runfiles
+
 # Do NOT implicitly create empty __init__.py files in the runfiles tree.
 # By default, these are created in every directory containing Python source code
 # or shared libraries, and every parent directory of those directories,
diff --git a/.bcr/gazelle/presubmit.yml b/.bcr/gazelle/presubmit.yml
index bceed4f9e1..ff1c9e7d58 100644
--- a/.bcr/gazelle/presubmit.yml
+++ b/.bcr/gazelle/presubmit.yml
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 bcr_test_module:
-  module_path: "../examples/bzlmod_build_file_generation"
+  module_path: "examples/bzlmod_build_file_generation"
   matrix:
     platform: ["debian11", "macos", "ubuntu2004", "windows"]
     # last_rc is to get latest 8.x release. Replace with 8.x when available.
@@ -23,6 +23,8 @@ bcr_test_module:
       name: "Run test module"
       platform: ${{ platform }}
       bazel: ${{ bazel }}
+      shell_commands:
+        - "echo 'common --override_module=rules_python=' >> .bazelrc"
       build_targets:
         - "//..."
         - ":modules_map"
diff --git a/examples/bzlmod_build_file_generation/other_module/MODULE.bazel b/examples/bzlmod_build_file_generation/other_module/MODULE.bazel
deleted file mode 100644
index 992e120760..0000000000
--- a/examples/bzlmod_build_file_generation/other_module/MODULE.bazel
+++ /dev/null
@@ -1,5 +0,0 @@
-module(
-    name = "other_module",
-)
-
-bazel_dep(name = "rules_python", version = "")
diff --git a/gazelle/.bazelignore b/gazelle/.bazelignore
new file mode 100644
index 0000000000..5930a06190
--- /dev/null
+++ b/gazelle/.bazelignore
@@ -0,0 +1,8 @@
+bazel-bin
+bazel-gazelle
+bazel-out
+bazel-testlogs
+examples/bzlmod_build_file_generation/bazel-bin
+examples/bzlmod_build_file_generation/bazel-bzlmod_build_file_generation
+examples/bzlmod_build_file_generation/bazel-out
+examples/bzlmod_build_file_generation/bazel-testlog
diff --git a/gazelle/.bazelrc b/gazelle/.bazelrc
index 791b93912a..9a38133e9d 100644
--- a/gazelle/.bazelrc
+++ b/gazelle/.bazelrc
@@ -1,3 +1,6 @@
+common --deleted_packages=examples/bzlmod_build_file_generation
+common --deleted_packages=examples/bzlmod_build_file_generation/runfiles
+
 test --test_output=errors
 
 # Do NOT implicitly create empty __init__.py files in the runfiles tree.
diff --git a/examples/bzlmod_build_file_generation/.bazelignore b/gazelle/examples/bzlmod_build_file_generation/.bazelignore
similarity index 100%
rename from examples/bzlmod_build_file_generation/.bazelignore
rename to gazelle/examples/bzlmod_build_file_generation/.bazelignore
diff --git a/examples/bzlmod_build_file_generation/.bazelrc b/gazelle/examples/bzlmod_build_file_generation/.bazelrc
similarity index 100%
rename from examples/bzlmod_build_file_generation/.bazelrc
rename to gazelle/examples/bzlmod_build_file_generation/.bazelrc
diff --git a/examples/bzlmod_build_file_generation/.gitignore b/gazelle/examples/bzlmod_build_file_generation/.gitignore
similarity index 100%
rename from examples/bzlmod_build_file_generation/.gitignore
rename to gazelle/examples/bzlmod_build_file_generation/.gitignore
diff --git a/examples/bzlmod_build_file_generation/BUILD.bazel b/gazelle/examples/bzlmod_build_file_generation/BUILD.bazel
similarity index 100%
rename from examples/bzlmod_build_file_generation/BUILD.bazel
rename to gazelle/examples/bzlmod_build_file_generation/BUILD.bazel
diff --git a/examples/bzlmod_build_file_generation/MODULE.bazel b/gazelle/examples/bzlmod_build_file_generation/MODULE.bazel
similarity index 91%
rename from examples/bzlmod_build_file_generation/MODULE.bazel
rename to gazelle/examples/bzlmod_build_file_generation/MODULE.bazel
index 3436fbf0af..5ace7f3d3a 100644
--- a/examples/bzlmod_build_file_generation/MODULE.bazel
+++ b/gazelle/examples/bzlmod_build_file_generation/MODULE.bazel
@@ -13,26 +13,28 @@ module(
 # For typical setups you set the version.
 # See the releases page for available versions.
 # https://github.com/bazel-contrib/rules_python/releases
-bazel_dep(name = "rules_python", version = "0.0.0")
+bazel_dep(name = "rules_python", version = "1.0.0")
 
+# NOTE: This override is removed for BCR presubmits and the version
+# specified by bazel_dep() is used instead.
 # The following loads rules_python from the file system.
 # For usual setups you should remove this local_path_override block.
 local_path_override(
     module_name = "rules_python",
-    path = "../..",
+    path = "../../..",
 )
 
 # The following stanza defines the dependency rules_python_gazelle_plugin.
 # For typical setups you set the version.
 # See the releases page for available versions.
 # https://github.com/bazel-contrib/rules_python/releases
-bazel_dep(name = "rules_python_gazelle_plugin", version = "0.0.0")
+bazel_dep(name = "rules_python_gazelle_plugin", version = "1.5.0")
 
 # The following starlark loads the gazelle plugin from the file system.
 # For usual setups you should remove this local_path_override block.
 local_path_override(
     module_name = "rules_python_gazelle_plugin",
-    path = "../../gazelle",
+    path = "../..",
 )
 
 # The following stanza defines the dependency for gazelle
@@ -84,7 +86,7 @@ use_repo(pip, "pip")
 
 # This project includes a different module that is on the local file system.
 # Add the module to this parent project.
-bazel_dep(name = "other_module", version = "", repo_name = "our_other_module")
+bazel_dep(name = "other_module", version = "0.0.0", repo_name = "our_other_module")
 local_path_override(
     module_name = "other_module",
     path = "other_module",
diff --git a/examples/bzlmod_build_file_generation/README.md b/gazelle/examples/bzlmod_build_file_generation/README.md
similarity index 100%
rename from examples/bzlmod_build_file_generation/README.md
rename to gazelle/examples/bzlmod_build_file_generation/README.md
diff --git a/examples/bzlmod_build_file_generation/WORKSPACE b/gazelle/examples/bzlmod_build_file_generation/WORKSPACE
similarity index 100%
rename from examples/bzlmod_build_file_generation/WORKSPACE
rename to gazelle/examples/bzlmod_build_file_generation/WORKSPACE
diff --git a/examples/bzlmod_build_file_generation/__main__.py b/gazelle/examples/bzlmod_build_file_generation/__main__.py
similarity index 100%
rename from examples/bzlmod_build_file_generation/__main__.py
rename to gazelle/examples/bzlmod_build_file_generation/__main__.py
diff --git a/examples/bzlmod_build_file_generation/__test__.py b/gazelle/examples/bzlmod_build_file_generation/__test__.py
similarity index 100%
rename from examples/bzlmod_build_file_generation/__test__.py
rename to gazelle/examples/bzlmod_build_file_generation/__test__.py
diff --git a/examples/bzlmod_build_file_generation/gazelle_python.yaml b/gazelle/examples/bzlmod_build_file_generation/gazelle_python.yaml
similarity index 100%
rename from examples/bzlmod_build_file_generation/gazelle_python.yaml
rename to gazelle/examples/bzlmod_build_file_generation/gazelle_python.yaml
diff --git a/examples/bzlmod_build_file_generation/gazelle_python_with_types.yaml b/gazelle/examples/bzlmod_build_file_generation/gazelle_python_with_types.yaml
similarity index 100%
rename from examples/bzlmod_build_file_generation/gazelle_python_with_types.yaml
rename to gazelle/examples/bzlmod_build_file_generation/gazelle_python_with_types.yaml
diff --git a/examples/bzlmod_build_file_generation/lib.py b/gazelle/examples/bzlmod_build_file_generation/lib.py
similarity index 100%
rename from examples/bzlmod_build_file_generation/lib.py
rename to gazelle/examples/bzlmod_build_file_generation/lib.py
diff --git a/gazelle/examples/bzlmod_build_file_generation/other_module/MODULE.bazel b/gazelle/examples/bzlmod_build_file_generation/other_module/MODULE.bazel
new file mode 100644
index 0000000000..3deeeb6ccc
--- /dev/null
+++ b/gazelle/examples/bzlmod_build_file_generation/other_module/MODULE.bazel
@@ -0,0 +1,7 @@
+module(
+    name = "other_module",
+)
+
+# Version doesn't matter because the root module overrides it,
+# but Bazel requires it exist in the registry.
+bazel_dep(name = "rules_python", version = "1.0.0")
diff --git a/examples/bzlmod_build_file_generation/other_module/WORKSPACE b/gazelle/examples/bzlmod_build_file_generation/other_module/WORKSPACE
similarity index 100%
rename from examples/bzlmod_build_file_generation/other_module/WORKSPACE
rename to gazelle/examples/bzlmod_build_file_generation/other_module/WORKSPACE
diff --git a/examples/bzlmod_build_file_generation/other_module/other_module/pkg/BUILD.bazel b/gazelle/examples/bzlmod_build_file_generation/other_module/other_module/pkg/BUILD.bazel
similarity index 100%
rename from examples/bzlmod_build_file_generation/other_module/other_module/pkg/BUILD.bazel
rename to gazelle/examples/bzlmod_build_file_generation/other_module/other_module/pkg/BUILD.bazel
diff --git a/examples/bzlmod_build_file_generation/other_module/other_module/pkg/data/data.txt b/gazelle/examples/bzlmod_build_file_generation/other_module/other_module/pkg/data/data.txt
similarity index 100%
rename from examples/bzlmod_build_file_generation/other_module/other_module/pkg/data/data.txt
rename to gazelle/examples/bzlmod_build_file_generation/other_module/other_module/pkg/data/data.txt
diff --git a/examples/bzlmod_build_file_generation/other_module/other_module/pkg/lib.py b/gazelle/examples/bzlmod_build_file_generation/other_module/other_module/pkg/lib.py
similarity index 100%
rename from examples/bzlmod_build_file_generation/other_module/other_module/pkg/lib.py
rename to gazelle/examples/bzlmod_build_file_generation/other_module/other_module/pkg/lib.py
diff --git a/examples/bzlmod_build_file_generation/requirements.in b/gazelle/examples/bzlmod_build_file_generation/requirements.in
similarity index 100%
rename from examples/bzlmod_build_file_generation/requirements.in
rename to gazelle/examples/bzlmod_build_file_generation/requirements.in
diff --git a/examples/bzlmod_build_file_generation/requirements_lock.txt b/gazelle/examples/bzlmod_build_file_generation/requirements_lock.txt
similarity index 100%
rename from examples/bzlmod_build_file_generation/requirements_lock.txt
rename to gazelle/examples/bzlmod_build_file_generation/requirements_lock.txt
diff --git a/examples/bzlmod_build_file_generation/requirements_windows.txt b/gazelle/examples/bzlmod_build_file_generation/requirements_windows.txt
similarity index 100%
rename from examples/bzlmod_build_file_generation/requirements_windows.txt
rename to gazelle/examples/bzlmod_build_file_generation/requirements_windows.txt
diff --git a/examples/bzlmod_build_file_generation/runfiles/BUILD.bazel b/gazelle/examples/bzlmod_build_file_generation/runfiles/BUILD.bazel
similarity index 100%
rename from examples/bzlmod_build_file_generation/runfiles/BUILD.bazel
rename to gazelle/examples/bzlmod_build_file_generation/runfiles/BUILD.bazel
diff --git a/examples/bzlmod_build_file_generation/runfiles/data/data.txt b/gazelle/examples/bzlmod_build_file_generation/runfiles/data/data.txt
similarity index 100%
rename from examples/bzlmod_build_file_generation/runfiles/data/data.txt
rename to gazelle/examples/bzlmod_build_file_generation/runfiles/data/data.txt
diff --git a/examples/bzlmod_build_file_generation/runfiles/runfiles_test.py b/gazelle/examples/bzlmod_build_file_generation/runfiles/runfiles_test.py
similarity index 100%
rename from examples/bzlmod_build_file_generation/runfiles/runfiles_test.py
rename to gazelle/examples/bzlmod_build_file_generation/runfiles/runfiles_test.py

From 6f80d342b1a0711dbb36eeff05b900733be7bf39 Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Sun, 19 Oct 2025 16:07:47 -0700
Subject: [PATCH 5/5] chore: fix release workflow (#3366)

My original change to use the bazel-contrib BCR publishing workflow was
horribly broken.
This fixes a variety of issues.

* Fix the workflow call secrets variable name
* Allow getting the BCR publishing token from the workflow arg (the
release
  workflow calls it)
* Fix the overall syntax of the workflows. It was just entirely invalid
in
  several regards.
* Fix the yaml -> yml file name reference. NGL, it took me longer than
I'd
  like to admit to see that, eh.

Along the way, some cleanups and improvements

* Allow specifying a particular tag to release, while using workflow
state from
a different commit. This allows us to make fixes on main, and then use
it to
  manually re-trigger a tag to be released.
* Add descriptions for workflow inputs
* Allow bcr token to be passed to release. This will allow e.g.
automatically
  scheduled releases.
* Quote shell variables because its good practice.
---
 .github/workflows/create_archive_and_notes.sh | 18 ++++--
 .github/workflows/publish.yml                 | 13 ++--
 .github/workflows/release.yml                 | 59 +++++++++++--------
 3 files changed, 53 insertions(+), 37 deletions(-)

diff --git a/.github/workflows/create_archive_and_notes.sh b/.github/workflows/create_archive_and_notes.sh
index b53c49aa09..a3cf8280a2 100755
--- a/.github/workflows/create_archive_and_notes.sh
+++ b/.github/workflows/create_archive_and_notes.sh
@@ -18,6 +18,17 @@ set -o pipefail
 set -o errexit
 
 set -x
+
+TAG=$1
+if [ -z "$TAG" ]; then
+  echo "ERROR: TAG env var must be set"
+  exit 1
+fi
+# If the workflow checks out one commit, but is releasing another
+git fetch origin tag "$TAG"
+# Update our local state so the grep command below searches what we expect
+git checkout "$TAG"
+
 # Exclude dot directories, specifically, this file so that we don't
 # find the substring we're looking for in our own file.
 # Exclude CONTRIBUTING.md, RELEASING.md because they document how to use these strings.
@@ -34,14 +45,11 @@ if [[ $grep_exit_code -eq 0 ]]; then
   exit 1
 fi
 
-# Set by GH actions, see
-# https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
-TAG=${GITHUB_REF_NAME}
 # A prefix is added to better match the GitHub generated archives.
 PREFIX="rules_python-${TAG}"
 ARCHIVE="rules_python-$TAG.tar.gz"
-git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip > $ARCHIVE
-SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
+git archive --format=tar "--prefix=${PREFIX}/" "$TAG" | gzip > "$ARCHIVE"
+SHA=$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')
 
 cat > release_notes.txt << EOF
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f03e02168f..9ad5308968 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,30 +1,28 @@
-# See https://github.com/bazel-contrib/publish-to-bcr
+# Publish new releases to Bazel Central Registry.
 name: Publish to BCR
-
 on:
   # Run the publish workflow after a successful release
-  # Can be triggered from the release.yaml workflow
+  # Will be triggered from the release.yaml workflow
   workflow_call:
     inputs:
       tag_name:
         required: true
         type: string
     secrets:
-      BCR_PUBLISH_TOKEN:
+      publish_token:
         required: true
   # In case of problems, let release engineers retry by manually dispatching
   # the workflow from the GitHub UI
   workflow_dispatch:
     inputs:
       tag_name:
+        description: git tag being released
         required: true
         type: string
-
 jobs:
   publish:
     uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.0.0
     with:
-      draft: false
       tag_name: ${{ inputs.tag_name }}
       # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
       registry_fork: bazel-contrib/bazel-central-registry
@@ -32,4 +30,5 @@ jobs:
     permissions:
       contents: write
     secrets:
-      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
+      # Necessary to push to the BCR fork, and to open a pull request against a registry
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0ed4992ccd..0d24d7913b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,51 +21,60 @@ on:
       - "*.*.*"
   workflow_dispatch:
     inputs:
+      tag_name:
+        description: "release tag: tag that will be released"
+        required: true
+        type: string
       publish_to_pypi:
         description: 'Publish to PyPI'
         required: true
         type: boolean
         default: true
+    secrets:
+      publish_token:
+        required: false
 
 jobs:
-  build:
+  release:
+    name: Release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v5
+        with:
+          ref: ${{ github.ref_name }}
       - name: Create release archive and notes
-        run: .github/workflows/create_archive_and_notes.sh
-
-  release:
-    name: Release
-    uses: softprops/action-gh-release@v2
-    with:
-      # Use GH feature to populate the changelog automatically
-      generate_release_notes: true
-      body_path: release_notes.txt
-      prerelease: ${{ contains(github.ref, '-rc') }}
-      fail_on_unmatched_files: true
-      files: rules_python-*.tar.gz
+        run: .github/workflows/create_archive_and_notes.sh ${{ inputs.tag_name || github.ref_name }}
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        with:
+          # Use GH feature to populate the changelog automatically
+          generate_release_notes: true
+          body_path: release_notes.txt
+          prerelease: ${{ contains( (inputs.tag_name || github.ref), '-rc') }}
+          fail_on_unmatched_files: true
+          files: rules_python-*.tar.gz
+          tag_name: ${{ inputs.tag_name || github.ref_name }}
 
   publish_bcr:
-    name: Publish to BCR
     needs: release
-    uses: .github/workflows/publish.yaml
+    uses: ./.github/workflows/publish.yml
     with:
-      tag_name: ${{ github.ref_name }}
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
     secrets:
-      BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
 
   publish_pypi:
     # We just want publish_pypi last, since once uploaded, it can't be changed.
     name: Publish runfiles to PyPI
     needs: publish_bcr
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.event.inputs.publish_to_pypi
-    env:
-      # This special value tells pypi that the user identity is supplied within the token
-      TWINE_USERNAME: __token__
-      # Note, the PYPI_API_TOKEN is for the rules-python pypi user, added by @rickylev on
-      # https://github.com/bazel-contrib/rules_python/settings/secrets/actions
-      TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-    run: bazel run --stamp --embed_label=${{ github.ref_name }} //python/runfiles:wheel.publish
+    steps:
+      - if: github.event_name == 'push' || github.event.inputs.publish_to_pypi
+        env:
+          # This special value tells pypi that the user identity is supplied within the token
+          TWINE_USERNAME: __token__
+          # Note, the PYPI_API_TOKEN is for the rules-python pypi user, added by @rickylev on
+          # https://github.com/bazel-contrib/rules_python/settings/secrets/actions
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        run: bazel run --stamp --embed_label=${{ inputs.tag_name || github.ref_name }} //python/runfiles:wheel.publish