release: publish release artifact

GitHub's stability guarantee for the archive is iffy, and we want metrics on downloads.
See bazel-contrib/SIG-rules-authors#11 (comment)

.bcr/source.template.json

@@ -1,5 +1,5 @@
 {
   "integrity": "**leave this alone**",
   "strip_prefix": "{REPO}-{VERSION}",
-  "url": "https://github.com/{OWNER}/{REPO}/archive/refs/tags/{TAG}.tar.gz"
+  "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/bazel-lib-{TAG}.tar.gz"
 }

.github/workflows/release.yml

@@ -46,6 +46,9 @@ jobs:
         with:
           # Use GH feature to populate the changelog automatically
           generate_release_notes: true
-          files: /tmp/aspect/release/*
+          files: |
+            /tmp/aspect/release/*
+            bazel-lib-*.tar.gz
           body_path: release_notes.txt
           token: ${{ secrets.DEREK_BCR_PAT }}
+          fail_on_unmatched_files: true

.github/workflows/workspace_snippet.sh → .github/workflows/release_prep.sh

@@ -5,8 +5,11 @@ set -o errexit -o nounset -o pipefail
 # Set by GH actions, see
 # https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
 TAG=${GITHUB_REF_NAME}
+# The prefix is chosen to match what GitHub generates for source archives
 PREFIX="bazel-lib-${TAG:1}"
-SHA=$(git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip | shasum -a 256 | awk '{print $1}')
+ARCHIVE="bazel-lib-$TAG.tar.gz"
+git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip > $ARCHIVE
+SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
 
 cat << EOF
 
@@ -32,7 +35,7 @@ http_archive(
     name = "aspect_bazel_lib",
     sha256 = "${SHA}",
     strip_prefix = "${PREFIX}",
-    url = "https://github.com/aspect-build/bazel-lib/archive/refs/tags/${TAG}.tar.gz",
+    url = "https://github.com/aspect-build/bazel-lib/releases/download/${TAG}/${ARCHIVE}",
 )
 
 load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")