.github/workflows/release: sign zip before sending pull request

The bazel attestations require a separate step.
We will be able to use //:small_tests in future releases,
but it does not exist yet in 2025-08-12.

Change-Id: I28e05de4ca3391fd9c87189ff3be3aeedea95ac4

Author: rsc

.github/workflows/release-bazel.yml

@@ -16,19 +16,27 @@ on:
       BCR_PUBLISH_TOKEN:
         description: 'Token for pushing to re2-machine/bazel-central-registry'
         required: true
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
 jobs:
-  release:
+  sign:
+    uses: bazel-contrib/.github/.github/workflows/[email protected]
+    with:
+      release_files: re2*.zip
+      prerelease: false
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+      bazel_test_command: 'bazel test //:re2_test'
+  send-pull-request:
+    needs: sign
     uses: bazel-contrib/publish-to-bcr/.github/workflows/[email protected]
     with:
       tag_name: ${{ inputs.tag_name }}
       # This workflow seems to require keeping a fork of the upstream to open
       # PRs from.
       registry_fork: re2-machine/bazel-central-registry
       attest: true
-    permissions:
-      contents: write
-      id-token: write
-      attestations: write
     secrets:
       # Necessary to push to the BCR fork, and to open a pull request against a registry
       publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}

.github/workflows/release.yml

@@ -33,6 +33,8 @@ jobs:
           # N.B. This is a whitespace-separated string!
           inputs: '*.tar.gz *.zip'
       - run: |
+          cp "re2-${GITHUB_REF_NAME}.zip.sigstore.json" \
+            "re2-${GITHUB_REF_NAME}.zip.intoto.jsonl"; \
           gh release upload "${GITHUB_REF_NAME}" \
             *.tar.gz *.zip *.sigstore* \
             --repo "${GITHUB_REPOSITORY}"

.github/workflows/release_prep.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+echo "$@"

BUILD.bazel

@@ -436,3 +436,24 @@ cc_binary(
         "@google_benchmark//:benchmark_main",
     ],
 )
+
+test_suite(
+    name = "small_tests",
+    tags = ["small"],
+    tests = [
+        ":charclass_test",
+        ":compile_test",
+        ":filtered_re2_test",
+        ":mimics_pcre_test",
+        ":parse_test",
+        ":possible_match_test",
+        ":re2_arg_test",
+        ":re2_test",
+        ":regexp_test",
+        ":required_prefix_test",
+        ":search_test",
+        ":set_test",
+        ":simplify_test",
+        ":string_generator_test",
+    ],
+)