Harden, remove experimental features

.bazelignore

@@ -0,0 +1 @@
+example/hello

.bazelversion

@@ -1 +1 @@
-8.5.1
+8.7.0

.github/workflows/ci.yml

@@ -0,0 +1,83 @@
+name: CI
+
+on:
+  merge_group:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    # Do not run untrusted fork code on an organization-owned runner.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    name: Go and Bazel
+    runs-on:
+      - self-hosted
+    timeout-minutes: 45
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          cache: true
+          cache-dependency-path: go.mod
+          go-version-file: go.mod
+
+      - name: Set up Bazel
+        uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
+        with:
+          bazelisk-cache: true
+          bazelisk-version: 1.29.0
+          cache-save: ${{ github.event_name != 'pull_request' }}
+          disk-cache: ${{ github.workflow }}
+          repository-cache: |
+            - go.mod
+            - MODULE.bazel
+            - MODULE.bazel.lock
+            - example/hello/MODULE.bazel
+            - example/hello/MODULE.bazel.lock
+
+      - name: Configure Go tool directory
+        shell: bash
+        run: |
+          set -euo pipefail
+          tool_bin="$RUNNER_TEMP/jvm_image/bin"
+          mkdir -p "$tool_bin"
+          echo "GOBIN=$tool_bin" >> "$GITHUB_ENV"
+          echo "$tool_bin" >> "$GITHUB_PATH"
+
+      - name: Install pinned Staticcheck
+        run: go install honnef.co/go/tools/cmd/staticcheck@v0.7.0
+
+      - name: Test Go packages
+        run: go test ./... -count=1
+
+      - name: Vet Go packages
+        run: go vet ./...
+
+      - name: Run Staticcheck
+        run: staticcheck ./...
+
+      - name: Test Bazel targets
+        run: bazel test //... --test_output=errors
+
+      - name: Build example image
+        working-directory: example/hello
+        run: bazel build //:image
+
+      - name: Verify generated files are current
+        run: git diff --exit-code

BUILD.bazel

@@ -1,14 +1,6 @@
-load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
-
 exports_files([
     "MODULE.bazel",
-    "jvm_image_layers.bzl",
+    "jvm_jar_layers.bzl",
 ])
 
 # gazelle:prefix github.com/stackb/jvm_image
-
-bzl_library(
-    name = "jvm_image_layers",
-    srcs = ["jvm_image_layers.bzl"],
-    visibility = ["//visibility:public"],
-)

MODULE.bazel

@@ -1,12 +1,14 @@
+"""Module definition and development toolchain configuration for jvm_image."""
+
 module(
     name = "jvm_image",
-    version = "0.0.0",
-    compatibility_level = 1,
+    version = "0.1.0",
 )
 
-bazel_dep(name = "bazel_skylib", version = "1.7.1")
+bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "gazelle", version = "0.47.0")
 bazel_dep(name = "rules_go", version = "0.59.0")
+bazel_dep(name = "rules_java", version = "8.14.0")
 
 bazel_dep(name = "buildifier_prebuilt", version = "8.2.1.2", dev_dependency = True)
 bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "1.9.0", dev_dependency = True)