Migrate pipeline from CircleCI to GitHub Actions

.github/workflows/main.yaml

@@ -0,0 +1,137 @@
+name: Main
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Check
+        run: ./go library:check
+      - name: Notify Slack
+        if: ${{ !cancelled() }}
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Test
+        run: ./go test:unit
+      - name: Notify Slack
+        if: ${{ !cancelled() }}
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  prerelease:
+    needs: [check, test]
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    # Job-level group (here and on release): a run awaiting release approval
+    # holds the slot, and a workflow-level group would freeze all main CI for
+    # the approval window. queue: max keeps every queued run; the default
+    # cancels all but the newest.
+    concurrency:
+      group: main
+      cancel-in-progress: false
+      queue: max
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Install secrets tools
+        run: ./scripts/ci/common/install-git-crypt.sh
+      - name: Unlock git-crypt
+        run: ./go git_crypt:unlock_with_encrypted_gpg_key
+        env:
+          ENCRYPTION_PASSPHRASE: ${{ secrets.ENCRYPTION_PASSPHRASE }}
+      - name: Configure RubyGems credentials
+        run: ./scripts/ci/common/configure-rubygems.sh
+      - name: Set CI git author
+        run: ./go repository:set_ci_author
+      - name: Bump version
+        run: ./go "version:bump[pre]"
+      - name: Release
+        run: ./go release
+      - name: Push commits
+        run: git push
+      - name: Push tags
+        run: git push --tags
+      - name: Notify Slack of release hold
+        continue-on-error: true
+        run: ./go "slack:notify[success,on_hold]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      - name: Notify Slack
+        if: ${{ !cancelled() }}
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  release:
+    needs: [prerelease]
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: release
+    concurrency:
+      group: main
+      cancel-in-progress: false
+      queue: max
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+      - name: Pull latest main
+        # Publishes main as of approval time, not the SHA that triggered the
+        # run; --ff-only so a non-fast-forward fails loudly
+        run: git pull --ff-only
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Install secrets tools
+        run: ./scripts/ci/common/install-git-crypt.sh
+      - name: Unlock git-crypt
+        run: ./go git_crypt:unlock_with_encrypted_gpg_key
+        env:
+          ENCRYPTION_PASSPHRASE: ${{ secrets.ENCRYPTION_PASSPHRASE }}
+      - name: Configure RubyGems credentials
+        run: ./scripts/ci/common/configure-rubygems.sh
+      - name: Set CI git author
+        run: ./go repository:set_ci_author
+      - name: Bump version
+        run: ./go "version:bump[patch]"
+      - name: Update documentation
+        run: ./go documentation:update
+      - name: Release
+        run: ./go release
+      - name: Push commits
+        run: git push
+      - name: Push tags
+        run: git push --tags
+      - name: Notify Slack
+        if: ${{ !cancelled() }}
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}