diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..e91e944
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,13 @@
+# In code review, collapse generated files
+docs/*.md linguist-generated=true
+
+#################################
+# Configuration for 'git archive'
+# See https://git-scm.com/docs/git-archive#ATTRIBUTES
+
+# Don't include examples in the distribution artifact, to reduce size.
+# You may want to add additional exclusions for folders or files that users don't need.
+examples export-ignore
+
+# Occasionally there's a need to "stamp" the release version into a file
+ytt/version.bzl export-subst
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
new file mode 100644
index 0000000..3b4aad2
--- /dev/null
+++ b/.github/workflows/ci.bazelrc
@@ -0,0 +1,15 @@
+# This file contains Bazel settings to apply on CI only.
+# It is referenced with a --bazelrc option in the call to bazel in ci.yaml
+
+# Debug where options came from
+build --announce_rc
+# This directory is configured in GitHub actions to be persisted between runs.
+# We do not enable the repository cache to cache downloaded external artifacts
+# as these are generally faster to download again than to fetch them from the
+# GitHub actions cache.
+build --disk_cache=~/.cache/bazel
+# Don't rely on test logs being easily accessible from the test runner,
+# though it makes the log noisier.
+test --test_output=errors
+# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
+test --test_env=XDG_CACHE_HOME
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..517447d
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,85 @@
+name: Main CI
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - labeled
+      - unlabeled
+      - opened
+      - edited
+      - reopened
+      - synchronize
+      - ready_for_review
+
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check-pr:
+    name: Validate Release Label and Notes
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set bump mode
+        id: mode
+        run: |
+          echo "reff=${{github.ref}}" >> $GITHUB_OUTPUT
+          echo "bump_mode=validate" >> $GITHUB_OUTPUT
+
+      - uses: jefflinse/pr-semver-bump@v1.6.0
+        name: Validate Pull Request Metadata
+        with:
+          mode: ${{ steps.mode.outputs.bump_mode }}
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          major-label: major release
+          minor-label: minor release
+          patch-label: patch release
+          noop-labels: not-a-release
+          release-notes-prefix: -- begin release notes --
+          release-notes-suffix: -- end release notes --
+          with-v: true
+          base-branch: true
+
+  build:
+    name: Build and Test
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+
+    - name: Cache Bazel
+      uses: actions/cache@v3
+      with:
+        path: |
+          ~/.cache/bazel
+        key: bazel-cache-${{ hashFiles('**/BUILD.bazel', '**/*.bzl', 'WORKSPACE') }}
+        restore-keys: bazel-cache-
+
+    - name: Build everything
+      env:
+        # Bazelisk will download bazel to here.
+        XDG_CACHE_HOME: ~/.cache/bazel-repo
+      run: bazel --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc build //...
+
+    - name: Test everything
+      env:
+        # Bazelisk will download bazel to here.
+        XDG_CACHE_HOME: ~/.cache/bazel-repo
+      run: bazel --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc test //...
+
+  release:
+    name: Release
+    # if: github.ref == 'refs/heads/main' && needs.check-pr.version != 'vnull'
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - check-pr
+      - build
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v5
+    with:
+      prerelease: true
+      release_files: rules_ytt-*.tar.gz
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
new file mode 100755
index 0000000..dabf256
--- /dev/null
+++ b/.github/workflows/release_prep.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+
+# Set by GH actions, see
+# https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
+TAG=${GITHUB_REF_NAME}
+# The prefix is chosen to match what GitHub generates for source archives
+# This guarantees that users can easily switch from a released artifact to a source archive
+# with minimal differences in their code (e.g. strip_prefix remains the same)
+PREFIX="rules_ytt-${TAG:1}"
+ARCHIVE="rules_ytt-$TAG.tar.gz"
+
+# NB: configuration for 'git archive' is in /.gitattributes
+git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip > $ARCHIVE
+SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
+
+cat << EOF
+Paste this snippet into your `WORKSPACE.bazel` file:
+
+\`\`\`starlark
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "rules_ytt",
+    sha256 = "${SHA}",
+    strip_prefix = "${PREFIX}",
+    url = "https://github.com/ekhabarov/rules_ytt/releases/download/${TAG}/${ARCHIVE}",
+)
+EOF
+
+#awk 'f;/--SNIP--/{f=1}' e2e/smoke/WORKSPACE.bazel
+echo "\`\`\`"