feat(release): automated release flow — BCR + SLSA L2 + Sigstore + SBOM

[Sam Gammon (sgammon)]

Turns the scaffolded-but-never-run release setup into a working automated flow. Built via the brainstorm → spec → plan → subagent-driven execution path; design at docs/superpowers/specs/2026-06-24-release-flow-slsa-bcr-design.md, plan at docs/superpowers/plans/2026-06-24-release-flow.md.

What it does

On merge of a release-please PR, .github/workflows/release.yml runs three gated jobs:

1. release-please — Conventional-Commits versioning; cuts tag vX.Y.Z + GitHub Release (CHANGELOG notes).
2. assets — builds source + Stardoc-docs tarballs (release_prep.sh), generates an SPDX SBOM (syft) enriched with the MODULE.bazel dep closure, uploads all three assets, and attests build provenance (SLSA Build L2) + the SBOM — signed keyless via Sigstore (Fulcio/Rekor).
3. bcr — publishes to the Bazel Central Registry via bazel-contrib/publish-to-bcr, called as a reusable-workflow job (sidesteps the GITHUB_TOKEN release-event recursion guard).

Key decisions

• SLSA Build L2 via GitHub-native attest-build-provenance (L3 via slsa-github-generator is documented out-of-scope).
• One orchestrated workflow — publish-to-bcr.yml is folded in; release_prep.sh, .bcr/*, and e2e/smoke are reused unchanged.
• release-please with manifest seeded to 0.0.0 + bump-minor-pre-major (no bump-patch-for-minor-pre-major) so the first release is v0.1.0 and pre-1.0 uses feat→minor / fix→patch.

Files

• Add: release-please-config.json, .release-please-manifest.json, tools/sbom_enrich.py (+ sbom_enrich_test.py, 3/3 passing), tools/sbom_prep.sh, RELEASING.md
• Rewrite: .github/workflows/release.yml
• Remove: .github/workflows/publish-to-bcr.yml
• Edit: README.md (release/provenance pointer), CHANGELOG.md (preserved; release-please appends)

⚠️ Prerequisites (maintainers, before the first release)

• PUBLISH_TOKEN secret with push access to the elide-dev/bazel-central-registry fork (already referenced by the old workflow).
• The first v0.1.0 release is the true end-to-end integration test — tag-triggered provenance/BCR can't be fully exercised locally.

Follow-ups (non-blocking, from review)

• First release should fold the hand-written CHANGELOG.md [Unreleased] section into release-please's generated 0.1.0 notes.
• Minor SBOM-tool polish (test coverage of filesAnalyzed/downloadLocation, encoding="utf-8", progress-count) deferred.

All actions pinned by SHA; every job hardened (step-security/harden-runner); per-job least-privilege permissions. Final whole-branch review passed (one blocker — the first-version mechanism — fixed in this branch).

[codspeed-hq]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

✅ 9 untouched benchmarks

---

_{Comparing feat/release-flow (a8ffe20) with main (b6c9c07)}

[Copilot]

Pull request overview

Implements an end-to-end automated release pipeline for rules_elide driven by release-please, producing GitHub Release assets (source/docs tarballs) with SPDX SBOM + Sigstore-backed GitHub attestations (SLSA Build L2), and publishing to the Bazel Central Registry via publish-to-bcr as a reusable workflow job.

Changes:

• Rewrites the release workflow to orchestrate release-please → asset build/SBOM/attestations → BCR publish, and removes the old release-triggered BCR workflow.
• Adds an SBOM enrichment utility (and local helper script) to merge direct bazel_dep entries from MODULE.bazel into the SPDX document.
• Adds release-please configuration and release documentation; updates README pointer and includes design/plan docs.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
tools/sbom_prep.sh	Local helper to generate an SPDX SBOM for the release tarball and run enrichment.
tools/sbom_enrich.py	Python utility to enrich SPDX SBOMs with direct MODULE.bazel bazel_dep packages + relationships.
tools/sbom_enrich_test.py	Unit tests for SBOM enrichment logic.
RELEASING.md	Maintainer-facing documentation for the automated release and provenance verification.
release-please-config.json	Release-please configuration for Conventional Commits-driven versioning and changelog updates.
README.md	Adds a pointer to the automated release/provenance documentation.
docs/superpowers/specs/2026-06-24-release-flow-slsa-bcr-design.md	Design document describing the intended release architecture.
docs/superpowers/plans/2026-06-24-release-flow.md	Implementation plan capturing steps/constraints for the release flow work.
.release-please-manifest.json	Seeds the release-please tracked version state.
.github/workflows/release.yml	Orchestrated workflow running release-please, building/uploading assets, generating/enriching SBOM, attesting provenance/SBOM, and publishing to BCR.
.github/workflows/publish-to-bcr.yml	Removed legacy workflow (release-event triggered BCR publish).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.