prepare 0.3.10 (#515) #41

	# Cut a release whenever a new tag is pushed to the repo.
	name: Release
	on:
	# Can be triggered from the tag.yaml workflow
	workflow_call:
	inputs:
	tag_name:
	required: true
	type: string
	secrets:
	publish_token:
	required: true
	# Or, developers can manually push a tag from their clone
	push:
	tags:
	- "v..*"
	permissions:
	id-token: write
	attestations: write
	contents: write
	jobs:
	release:
	uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.4.0
	with:
	release_files: \|
	dist/rules_img-*.tar.gz
	dist/rules_img_tool-*.tar.gz
	dist/rules_img_pull_tool-*.tar.gz
	dist/img_linux_*
	dist/img_darwin_*
	dist/img_windows_*.exe
	dist/pull_tool_linux_*
	dist/pull_tool_darwin_*
	dist/pull_tool_windows_*.exe
	dist/*.docs.tar.gz
	prerelease: false
	tag_name: ${{ inputs.tag_name \|\| github.ref_name }}
	secrets:
	inherit
	publish:
	needs: release
	uses: ./.github/workflows/publish.yaml
	with:
	tag_name: ${{ inputs.tag_name \|\| github.ref_name }}
	secrets:
	publish_token: ${{ secrets.publish_token \|\| secrets.BCR_PUBLISH_TOKEN }}
	create_tool_tags:
	runs-on: ubuntu-latest
	needs: release
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
	- name: Create img_tool and pull_tool tags
	env:
	TAG_NAME: ${{ inputs.tag_name \|\| github.ref_name }}
	run: \|
	git tag "img_tool/${TAG_NAME}" "${TAG_NAME}"
	git tag "pull_tool/${TAG_NAME}" "${TAG_NAME}"
	git push origin "img_tool/${TAG_NAME}" "pull_tool/${TAG_NAME}"

Provide feedback