Update all the things, move the CLI back into this repo, use toolchains instead of bind, and support new Bazel worker options

.bazelrc

@@ -2,10 +2,19 @@ startup --expand_configs_in_place
 
 common:ci --color=yes
 
-# At least until https://github.com/lucidsoftware/rules_scala/pull/40 is merged
-common --incompatible_java_common_parameters=false
+build --strategy=worker,sandboxed,local
+build --verbose_failures
+
+build --incompatible_strict_action_env
+build --experimental_worker_multiplex_sandboxing
+build --experimental_worker_cancellation
+build --worker_sandboxing
+
+build --java_language_version="21"
+build --java_runtime_version="remotejdk_21"
+build --tool_java_language_version="21"
+build --tool_java_runtime_version="remotejdk_21"
 
-build:ci --verbose_failures
 build:ci --sandbox_debug
 build:ci --spawn_strategy=standalone
 build:ci --genrule_strategy=standalone

.bazelversion

@@ -1 +1 @@
-bazelbuild/6.3.2
+bazelbuild/7.3.1

.github/workflows/ci.yml

@@ -11,12 +11,37 @@ jobs:
       USE_BAZEL_VERSION: ${{ matrix.bazel_version }}
     strategy:
       matrix:
-        os: [ubuntu-20.04]
-        bazel_version: [bazelbuild/5.4.0, bazelbuild/6.3.2]
+        os: [ubuntu-24.04]
+        bazel_version: [bazelbuild/7.3.1]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/[email protected]
+      - uses: actions/[email protected]
+      - uses: bazel-contrib/[email protected]
+        with:
+          bazelisk-version: 1.20.0
       - run: cat .bazelrc.ci >> .bazelrc
-      - run: ./scripts/lint.sh
+      - run: ./scripts/format.sh check
       - run: ./test/run_all_tests.sh ci
       - run: ./scripts/gen-docs.sh && git diff --exit-code docs/
       - run: bazel shutdown
+
+  publish:
+    if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
+    needs: build-and-test
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/[email protected]
+      - uses: actions/[email protected]
+      - uses: bazel-contrib/[email protected]
+        with:
+          bazelisk-version: 1.20.0
+      - run: cat .bazelrc.ci >> .bazelrc
+      - name: Import gpg keys
+        run: echo "$PGP_SECRET" | base64 --decode | gpg --import
+        env:
+          PGP_SECRET: ${{ secrets.PGP_SECRET }}
+      - name: Publish to Maven
+        run: ./scripts/publish.sh
+        env:
+          MAVEN_USER: ${{ secrets.SONATYPE_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}

BUILD.bazel

@@ -1,3 +1,24 @@
-load("@com_github_bazelbuild_buildtools//buildifier:def.bzl", "buildifier")
+load("@com_github_bazelbuild_buildtools//buildifier:def.bzl", "buildifier", "buildifier_test")
+load(
+    "@rules_java//toolchains:default_java_toolchain.bzl",
+    "DEFAULT_TOOLCHAIN_CONFIGURATION",
+    "default_java_toolchain",
+)
 
-buildifier(name = "buildifier")
+default_java_toolchain(
+    name = "repository_default_toolchain_21",
+    configuration = DEFAULT_TOOLCHAIN_CONFIGURATION,
+    java_runtime = "@rules_java//toolchains:remotejdk_21",
+    javac_supports_worker_multiplex_sandboxing = True,
+    source_version = "21",
+    target_version = "21",
+)
+
+buildifier(
+    name = "buildifier",
+)
+
+buildifier_test(
+    name = "buildifier_check",
+    mode = "check",
+)

MODULE.bazel

@@ -0,0 +1,6 @@
+###############################################################################
+# Bazel now uses Bzlmod by default to manage external dependencies.
+# Please consider migrating your external dependencies from WORKSPACE to MODULE.bazel.
+#
+# For more details, please check https://github.com/bazelbuild/bazel/issues/18958
+###############################################################################