diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
new file mode 100644
index 000000000..77b7c4da0
--- /dev/null
+++ b/.github/workflows/main.yml
@@ -0,0 +1,180 @@
+# GitHub actions for Autobahn|Python CI/CD
+# https://github.com/crossbario/autobahn-python/actions
+#
+# See also:
+#
+#   * https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
+#   * https://github.com/actions/starter-workflows/blob/main/ci/python-package.yml
+#
+name: main
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Install OS package dependencies
+      run: |
+        sudo apt update
+        sudo apt install libenchant-dev libbz2-dev libsnappy-dev libunwind-dev
+
+    - name: Set up Python 3.8
+      uses: actions/setup-python@v2
+      with:
+        python-version: '3.8'
+        architecture: 'x64'
+
+    - name: Install Python package dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r requirements-dev.txt
+
+    - name: Run Flake8
+      run: tox -c tox.ini -e flake8
+
+    # since we use --parallel-mode to coverage inside Tox we use
+    # "coverage combine" so the filename is always ".coverage"
+    - name: Run Coverage
+      run: |
+        tox -c tox.ini -e coverage
+        coverage combine && codecov
+
+  test:
+    env:
+      CB_FULLTESTS: 1
+
+    # Test on Ubuntu, MacOS, Windows using CPython 3.6-3.9, PyPy 3.6-3.7
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        # os: [ubuntu-latest, macos-latest, windows-latest]
+
+        # https://github.com/actions/setup-python#specifying-a-pypy-version
+        python-version: ['3.6', '3.7', '3.8', '3.9', 'pypy-3.6', 'pypy-3.7']
+
+    # https://github.blog/changelog/2020-04-15-github-actions-new-workflow-features/
+    # https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepscontinue-on-error
+    continue-on-error: false
+
+    steps:
+    # Checkout sources
+    - uses: actions/checkout@v2
+
+    # Install OS packages, as we install Python packages from source:
+    # libenchant-dev: needed for pyenchant, needed for sphinx-spellcheck
+    # libbz2-dev, libsnappy-dev: needed for compression
+    # libunwind-dev: needed for vmprof
+    - name: Install OS package dependencies
+      run: |
+        sudo apt update
+        sudo apt install build-essential libssl-dev libffi-dev libunwind-dev \
+          libreadline-dev zlib1g-dev libbz2-dev libsqlite3-dev libncurses5-dev \
+          libsnappy-dev
+
+    # Use this Python
+    # https://github.com/actions/setup-python/blob/main/README.md
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v2
+      with:
+        python-version: ${{ matrix.python-version }}
+
+    - name: Install Python package dependencies
+      run: |
+        python -m pip install -U pip
+        pip install -U -r requirements-dev.txt
+
+    - name: Install this package
+      run: |
+        pip install .
+
+    - name: Run unit tests (PyTest)
+      run: |
+        tox -c tox.ini
+
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Install OS package dependencies
+      run: |
+        sudo apt update
+        sudo apt install libenchant-dev libbz2-dev libsnappy-dev libunwind-dev
+
+    - name: Set up Python 3.8
+      uses: actions/setup-python@v2
+      with:
+        python-version: '3.8'
+        architecture: 'x64'
+
+    - name: Install Python package dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r requirements-dev.txt
+
+    - name: Run Sphinx
+      run: tox -c tox.ini -e sphinx
+
+  deploy:
+    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
+
+    # https://github.blog/changelog/2020-12-15-github-actions-environments-environment-protection-rules-and-environment-secrets-beta/
+    # https://docs.github.com/en/free-pro-team@latest/actions/reference/environments
+    environment: deploy_aws
+
+    env:
+      AWS_DEFAULT_REGION:    ${{ secrets.AWS_DEFAULT_REGION }}
+      AWS_S3_BUCKET_NAME:    ${{ secrets.AWS_S3_BUCKET_NAME }}
+      AWS_ACCESS_KEY_ID:     ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      WAMP_PRIVATE_KEY:      ${{ secrets.WAMP_PRIVATE_KEY }}
+
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+
+    # https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
+    # https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-commands-for-github-actions#adding-a-system-path
+    - name: Set environment
+      run: |
+        echo "${HOME}/.local/bin" >> $GITHUB_PATH
+        echo BUILD_DATE=`date -u +"%Y-%m-%d"` >> $GITHUB_ENV
+        echo AUTOBAHN_VCS_REF=`git rev-parse --short ${GITHUB_SHA}` >> $GITHUB_ENV
+        echo AUTOBAHN_BUILD_ID=$(date --utc +%Y%m%d)-$(git rev-parse --short ${GITHUB_SHA}) >> $GITHUB_ENV
+        echo AUTOBAHN_VERSION=$(grep -E '^(__version__)' ./zlmdb/_version.py | cut -d ' ' -f3 | sed -e 's|[u"'\'']||g') >> $GITHUB_ENV
+
+    # - name: Set environment - 2
+    #   run: |
+    #     echo AUTOBAHN_VCS_REF=`git --git-dir="./.git" rev-list -n 1 v${AUTOBAHN_VERSION} --abbrev-commit` >> $GITHUB_ENV
+
+    - name: Install OS package dependencies
+      run: |
+        sudo apt update
+        sudo apt install build-essential libssl-dev libffi-dev libunwind-dev \
+          libreadline-dev zlib1g-dev libbz2-dev libsqlite3-dev libncurses5-dev \
+          libsnappy-dev
+
+    - name: Set up Python 3.x
+      uses: actions/setup-python@v2
+      with:
+        python-version: '3.x'
+        architecture: 'x64'
+
+    - name: Install Python package dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r requirements-dev.txt
+
+    - name: Deploy (build, package and upload)
+      run: |
+        ./deploy.sh
diff --git a/.travis-deploy.sh b/deploy.sh
similarity index 65%
rename from .travis-deploy.sh
rename to deploy.sh
index 9a884405a..e5ffbdf2a 100755
--- a/.travis-deploy.sh
+++ b/deploy.sh
@@ -2,39 +2,17 @@
 
 set +o verbose -o errexit
 
-# AUTOBAHN_VERSION             : must be set in travis.yml!
-export AWS_DEFAULT_REGION=eu-central-1
-export AWS_S3_BUCKET_NAME=crossbarbuilder
-# AWS_ACCESS_KEY_ID         : must be set in Travis CI build context!
-# AWS_SECRET_ACCESS_KEY     : must be set in Travis CI build context!
-# WAMP_PRIVATE_KEY          : must be set in Travis CI build context!
+# AWS_DEFAULT_REGION        : must be set in CI build context!
+# AWS_S3_BUCKET_NAME        : must be set in CI build context!
+# AWS_ACCESS_KEY_ID         : must be set in CI build context!
+# AWS_SECRET_ACCESS_KEY     : must be set in CI build context!
+# WAMP_PRIVATE_KEY          : must be set in CI build context!
 
-# TRAVIS_BRANCH, TRAVIS_PULL_REQUEST, TRAVIS_TAG
+echo 'AWS env vars (should be 4):'
+env | grep AWS_ | wc -l
 
-# PR => don't deploy and exit
-if [ "$TRAVIS_PULL_REQUEST" = "true" ]; then
-    echo '[1] deploy script called for PR - exiting ..';
-    exit 0;
-
-# direct push to master => deploy
-elif [ "$TRAVIS_BRANCH" = "master" -a "$TRAVIS_PULL_REQUEST" = "false" ]; then
-    echo '[2] deploy script called for direct push to master: continuing to deploy!';
-
-# tagged release => deploy
-elif [ -n "$TRAVIS_TAG" ]; then
-    echo '[3] deploy script called for tagged release: continuing to deploy!';
-
-# outside travis? => deploy
-else
-    echo '[?] deploy script called outside Travis? continuing to deploy!';
-
-fi
-
-# only show number of env vars .. should be 4 on master branch!
-# https://docs.travis-ci.com/user/pull-requests/#Pull-Requests-and-Security-Restrictions
-# Travis CI makes encrypted variables and data available only to pull requests coming from the same repository.
-echo 'aws env vars (should be 4 - but only on master branch!):'
-env | grep AWS | wc -l
+echo 'WAMP_PRIVATE_KEY env var (should be 1):'
+env | grep WAMP_PRIVATE_KEY | wc -l
 
 # set up awscli package
 echo 'installing aws tools ..'
diff --git a/requirements-dev.txt b/requirements-dev.txt
new file mode 100644
index 000000000..98593c852
--- /dev/null
+++ b/requirements-dev.txt
@@ -0,0 +1,20 @@
+pip>=9.0.1
+bumpversion>=0.5.3
+wheel>=0.30.0
+watchdog>=0.8.3
+flake8>=3.5.0
+tox>=2.9.1
+tox-gh-actions>=2.2.0
+codecov>=2.0.15
+sphinx>=1.7.1
+twine>=1.10.0
+pytest>=3.4.2
+pytest-runner>=2.11.1
+humanize>=0.5.1
+backports.tempfile>=1.0
+# https://github.com/google/yapf/issues/712
+yapf==0.29.0
+pylint>=1.9.2
+pyyaml>=4.2b4
+mypy>=0.610; python_version >= '3.4' and platform_python_implementation != 'PyPy'
+twisted>=18.7.0
diff --git a/tox.ini b/tox.ini
index 2344c016b..ea8bd8ea4 100644
--- a/tox.ini
+++ b/tox.ini
@@ -11,7 +11,24 @@ envlist =
     py39-{tw189,tw1910,twtrunk,asyncio}
 
     # PyPy
-    pypy3-{tw189,tw1910,twtrunk,asyncio}
+    pypy37-{tw189,tw1910,twtrunk,asyncio}
+
+
+# MAP: GitHub Actions Python Name => Tox Env Name (for Python)
+#
+# when called without a specific environment ("-e"), detect the
+# python version / get from GH action, and map to tox env
+#
+# https://github.com/ymyzk/tox-gh-actions
+#
+[gh-actions]
+python =
+    3.6: py36
+    3.7: py37
+    3.8: py38
+    3.9: py39
+    pypy-3.6: pypy36
+    pypy-3.7: pypy37
 
 
 [testenv]
@@ -30,10 +47,7 @@ deps =
     {tw189,tw1910,twtrunk}: pytest-twisted
 
     ; asyncio dependencies
-    py36-asyncio: pytest_asyncio
-    py37-asyncio: pytest_asyncio
-    py38-asyncio: pytest_asyncio
-    pypy3-asyncio: pytest_asyncio
+    asyncio: pytest_asyncio
 
 extras =
     encryption
@@ -87,7 +101,6 @@ setenv =
 
 
 [testenv:flake8]
-basepython = python3
 skip_install = True
 deps =
     flake8