diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index 2817a92f..00000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,183 +0,0 @@
-version: 2.1
-
-orbs:
-  slack: circleci/slack@4.13.2
-
-base_container: &base_container
-  image: buildpack-deps:bookworm
-
-build_container: &build_container
-  resource_class: arm.medium
-  docker:
-    - <<: *base_container
-
-slack_context: &slack_context
-  context:
-    - slack
-
-only_main: &only_main
-  filters:
-    branches:
-      only:
-        - main
-
-only_dependabot: &only_dependabot
-  filters:
-    branches:
-      only:
-        - /^dependabot.*/
-
-only_main_and_dependabot: &only_main_and_dependabot
-  filters:
-    branches:
-      only:
-        - main
-        - /^dependabot.*/
-
-commands:
-  notify:
-    steps:
-      - when:
-          condition:
-            matches:
-              pattern: "^dependabot.*"
-              value: << pipeline.git.branch >>
-          steps:
-            - slack/notify:
-                event: fail
-                channel: builds-dependabot
-                template: SLACK_FAILURE_NOTIFICATION
-            - slack/notify:
-                event: pass
-                channel: builds-dependabot
-                template: SLACK_SUCCESS_NOTIFICATION
-      - when:
-          condition:
-            matches:
-              pattern: "^(?!dependabot).*"
-              value: << pipeline.git.branch >>
-          steps:
-            - slack/notify:
-                event: fail
-                channel: dev
-                template: SLACK_FAILURE_NOTIFICATION
-            - slack/notify:
-                event: pass
-                channel: builds
-                template: SLACK_SUCCESS_NOTIFICATION
-
-  configure_build_tools:
-    steps:
-      - run: ./scripts/ci/common/install-slack-deps.sh
-      - restore_cache:
-          keys:
-            - asdf-dependencies-{{ arch }}-v2-{{ checksum ".tool-versions" }}
-            - asdf-dependencies-{{ arch }}-v2-
-      - run: ./scripts/ci/common/install-asdf.sh
-      - run: ./scripts/ci/common/configure-asdf.sh
-      - run: ./scripts/ci/common/install-asdf-dependencies.sh
-      - save_cache:
-          key: asdf-dependencies-{{ arch }}-v2-{{ checksum ".tool-versions" }}
-          paths:
-            - ~/.asdf
-
-  configure_secrets_tools:
-    steps:
-      - run: ./scripts/ci/common/install-git-crypt.sh
-      - run: ./scripts/ci/common/install-gpg-key.sh
-      - run: ./scripts/ci/common/configure-git.sh
-
-  configure_release_tools:
-    steps:
-      - add_ssh_keys:
-          fingerprints:
-            - "SHA256:llKoU4DFV189TLH/gucs4eytL2Z1KN7jRN4NmDesD8g"
-      - run: ./scripts/ci/common/configure-rubygems.sh
-
-  configure_tools:
-    steps:
-      - configure_build_tools
-      - configure_secrets_tools
-      - configure_release_tools
-
-jobs:
-  build:
-    <<: *build_container
-    steps:
-      - checkout
-      - configure_tools
-      - run: ./scripts/ci/steps/build.sh
-      - notify
-
-  test:
-    <<: *build_container
-    steps:
-      - checkout
-      - configure_tools
-      - run: ./scripts/ci/steps/test.sh
-      - notify
-
-  prerelease:
-    <<: *build_container
-    steps:
-      - checkout
-      - configure_tools
-      - run: ./scripts/ci/steps/prerelease.sh
-      - notify
-
-  release:
-    <<: *build_container
-    steps:
-      - checkout
-      - configure_tools
-      - run: ./scripts/ci/steps/release.sh
-      - notify
-
-  merge_pull_request:
-    <<: *build_container
-    steps:
-      - checkout
-      - configure_tools
-      - run: ./scripts/ci/steps/merge-pull-request.sh
-      - notify
-
-workflows:
-  version: 2
-  pipeline:
-    jobs:
-      - build:
-          <<: *only_main_and_dependabot
-          <<: *slack_context
-      - test:
-          <<: *only_main_and_dependabot
-          <<: *slack_context
-          requires:
-            - build
-      - merge_pull_request:
-          <<: *only_dependabot
-          <<: *slack_context
-          requires:
-            - test
-      - prerelease:
-          <<: *only_main
-          <<: *slack_context
-          requires:
-            - test
-      - slack/on-hold:
-          <<: *only_main
-          <<: *slack_context
-          requires:
-            - prerelease
-          channel: release
-          template: SLACK_ON_HOLD_NOTIFICATION
-      - hold:
-          <<: *only_main
-          type: approval
-          requires:
-            - prerelease
-            - slack/on-hold
-      - release:
-          <<: *only_main
-          <<: *slack_context
-          requires:
-            - hold
diff --git a/.circleci/gpg.private.enc b/.github/gpg.private.enc
similarity index 100%
rename from .circleci/gpg.private.enc
rename to .github/gpg.private.enc
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
new file mode 100644
index 00000000..a0ba4798
--- /dev/null
+++ b/.github/workflows/main.yaml
@@ -0,0 +1,149 @@
+name: Main
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+# Every run publishes to RubyGems; serialise so close-together merges cannot
+# race on version numbers. queue: max keeps every queued run (the default
+# keeps only the newest pending), so a slow release approval delays later
+# prereleases instead of cancelling them.
+concurrency:
+  group: main
+  cancel-in-progress: false
+  queue: max
+
+jobs:
+  skip-ci-check:
+    runs-on: ubuntu-latest
+    outputs:
+      should_skip_ci: ${{ steps.skip_ci_check.outputs.should_skip_ci }}
+    steps:
+      - id: skip_ci_check
+        env:
+          HEAD_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+        run: |
+          if [[ "$HEAD_COMMIT_MESSAGE" == *"[no ci]"* ]] \
+            || [[ "$HEAD_COMMIT_MESSAGE" == *"[skip ci]"* ]] \
+            || [[ "$HEAD_COMMIT_MESSAGE" == *"[ci skip]"* ]]; then
+            echo "should_skip_ci=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "should_skip_ci=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  check:
+    needs: [skip-ci-check]
+    if: needs.skip-ci-check.outputs.should_skip_ci != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Check
+        run: ./go library:check
+      - name: Notify Slack
+        if: always()
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  test:
+    needs: [skip-ci-check]
+    if: needs.skip-ci-check.outputs.should_skip_ci != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Test
+        run: ./go test:unit
+      - name: Notify Slack
+        if: always()
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  prerelease:
+    needs: [check, test]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Install secrets tools
+        run: sudo apt-get update && sudo apt-get install -y git-crypt gnupg
+      - name: Unlock git-crypt
+        run: ./go git_crypt:unlock_with_encrypted_gpg_key
+        env:
+          ENCRYPTION_PASSPHRASE: ${{ secrets.ENCRYPTION_PASSPHRASE }}
+      - name: Configure RubyGems credentials
+        run: |
+          mkdir -p ~/.gem
+          cp config/secrets/rubygems/credentials ~/.gem/credentials
+          chmod 0600 ~/.gem/credentials
+      - name: Set CI git author
+        run: ./go repository:set_ci_author
+      - name: Prerelease
+        run: ./go "version:bump[pre]" && ./go release
+      - name: Push release commit
+        run: git push && git push --tags
+      - name: Notify Slack of release hold
+        continue-on-error: true
+        run: ./go "slack:notify[success,on_hold]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      - name: Notify Slack
+        if: always()
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  release:
+    needs: [prerelease]
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+      - name: Pull latest main
+        # Approval can land long after the run starts; release publishes main
+        # as of approval time, not the tested SHA — parity with the old
+        # release.sh, which also pulled. prerelease.sh never pulled, so the
+        # prerelease job deliberately has no pull.
+        run: git pull
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Install secrets tools
+        run: sudo apt-get update && sudo apt-get install -y git-crypt gnupg
+      - name: Unlock git-crypt
+        run: ./go git_crypt:unlock_with_encrypted_gpg_key
+        env:
+          ENCRYPTION_PASSPHRASE: ${{ secrets.ENCRYPTION_PASSPHRASE }}
+      - name: Configure RubyGems credentials
+        run: |
+          mkdir -p ~/.gem
+          cp config/secrets/rubygems/credentials ~/.gem/credentials
+          chmod 0600 ~/.gem/credentials
+      - name: Set CI git author
+        run: ./go repository:set_ci_author
+      - name: Release
+        run: ./go "version:bump[patch]" && ./go documentation:update && ./go release
+      - name: Push release commit
+        run: git push && git push --tags
+      - name: Notify Slack
+        if: always()
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
new file mode 100644
index 00000000..f251e124
--- /dev/null
+++ b/.github/workflows/pr.yaml
@@ -0,0 +1,66 @@
+name: Pull Request
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Check
+        run: ./go library:check
+      - name: Notify Slack
+        if: always()
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Test
+        run: ./go test:unit
+      - name: Notify Slack
+        if: always()
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        uses: infrablocks/github-actions/asdf_install@v1
+      - name: Build
+        run: ./go library:build
+      - name: Notify Slack
+        if: always()
+        continue-on-error: true
+        run: ./go "slack:notify[${{ job.status }}]"
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  merge-pull-request:
+    needs: [check, test, build]
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Merge pull request
+        run: gh pr merge --merge "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/Gemfile.lock b/Gemfile.lock
index cc057a8a..f68a7acf 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,33 +8,34 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.2.3.1)
+    activesupport (8.1.3)
       base64
-      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      json
       logger (>= 1.4.2)
-      minitest (>= 5.1, < 6)
+      minitest (>= 5.1)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
     base64 (0.3.0)
-    benchmark (0.5.0)
     bigdecimal (4.1.2)
     childprocess (5.0.0)
     coderay (1.1.3)
     colored2 (3.1.2)
     concurrent-ruby (1.3.7)
-    connection_pool (2.5.5)
+    connection_pool (3.0.2)
     diff-lcs (1.6.2)
     docile (1.4.0)
     drb (2.2.3)
-    excon (0.111.0)
+    excon (1.5.0)
+      logger
     faker (3.6.1)
       i18n (>= 1.8.11, < 2)
     faraday (2.14.3)
@@ -43,10 +44,10 @@ GEM
       logger
     faraday-net_http (3.4.4)
       net-http (~> 0.5)
-    ffi (1.17.3)
-    ffi (1.17.3-arm64-darwin)
-    ffi (1.17.3-x86_64-darwin)
-    ffi (1.17.3-x86_64-linux-gnu)
+    ffi (1.17.4)
+    ffi (1.17.4-arm64-darwin)
+    ffi (1.17.4-x86_64-darwin)
+    ffi (1.17.4-x86_64-linux-gnu)
     formatador (1.2.3)
       reline
     gem-release (2.2.4)
@@ -88,7 +89,9 @@ GEM
     logger (1.7.0)
     lumberjack (1.4.2)
     method_source (1.1.0)
-    minitest (5.27.0)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
     nenv (0.3.0)
     net-http (0.9.1)
       uri (>= 0.11.1)
@@ -108,15 +111,10 @@ GEM
       coderay (~> 1.1)
       method_source (~> 1.0)
       reline (>= 0.6.0)
-    public_suffix (6.0.2)
+    public_suffix (7.0.5)
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.4.2)
-    rake_circle_ci (0.13.0)
-      colored2 (~> 3.1)
-      excon (~> 0.72)
-      rake_factory (~> 0.33)
-      sshkey (~> 2.0)
     rake_factory (0.33.0)
       activesupport (>= 4)
       rake (~> 13.0)
@@ -124,8 +122,9 @@ GEM
       colored2 (~> 3.1)
       git (~> 1.13, >= 1.13.2)
       rake_factory (~> 0.33)
-    rake_git_crypt (0.2.0)
+    rake_git_crypt (0.4.0)
       colored2 (~> 3.1)
+      lino (~> 4.1)
       rake_factory (~> 0.33)
       ruby_git_crypt (~> 0.1)
       ruby_gpg2 (~> 0.12)
@@ -138,10 +137,9 @@ GEM
     rake_gpg (0.20.0)
       rake_factory (~> 0.33)
       ruby_gpg2 (~> 0.12)
-    rake_ssh (0.12.0)
-      colored2 (~> 3.1)
+    rake_slack (0.3.0)
+      excon (>= 0.72, < 2.0)
       rake_factory (~> 0.33)
-      sshkey (~> 2.0)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
@@ -227,12 +225,11 @@ DEPENDENCIES
   guard
   guard-rspec
   rake
-  rake_circle_ci
   rake_git
   rake_git_crypt
   rake_github
   rake_gpg
-  rake_ssh
+  rake_slack
   rspec
   rubocop
   rubocop-rake
diff --git a/README.md b/README.md
index 66f9fd78..b6f165b2 100644
--- a/README.md
+++ b/README.md
@@ -348,16 +348,16 @@ To check for code linting / formatting issues without fixing:
 You can also run `bin/console` for an interactive prompt that will allow you to
 experiment.
 
-### Managing CircleCI keys
+### Managing CI keys
 
-To encrypt a GPG key for use by CircleCI:
+To encrypt a GPG key for use by CI:
 
 ```bash
 openssl aes-256-cbc \
   -e \
   -md sha1 \
   -in ./config/secrets/ci/gpg.private \
-  -out ./.circleci/gpg.private.enc \
+  -out ./.github/gpg.private.enc \
   -k "<passphrase>"
 ```
 
@@ -367,7 +367,7 @@ To check decryption is working correctly:
 openssl aes-256-cbc \
   -d \
   -md sha1 \
-  -in ./.circleci/gpg.private.enc \
+  -in ./.github/gpg.private.enc \
   -k "<passphrase>"
 ```
 
diff --git a/Rakefile b/Rakefile
index 0866c073..9a8090a8 100644
--- a/Rakefile
+++ b/Rakefile
@@ -1,11 +1,10 @@
 # frozen_string_literal: true
 
-require 'rake_circle_ci'
 require 'rake_git'
 require 'rake_git_crypt'
 require 'rake_github'
 require 'rake_gpg'
-require 'rake_ssh'
+require 'rake_slack'
 require 'rspec/core/rake_task'
 require 'rubocop/rake_task'
 require 'securerandom'
@@ -60,13 +59,6 @@ namespace :encryption do
 end
 
 namespace :keys do
-  namespace :deploy do
-    RakeSSH.define_key_tasks(
-      path: 'config/secrets/ci/',
-      comment: 'maintainers@infrablocks.io'
-    )
-  end
-
   namespace :gpg do
     RakeGPG.define_generate_key_task(
       output_directory: 'config/secrets/ci',
@@ -92,7 +84,6 @@ namespace :secrets do
   desc 'Generate all generatable secrets.'
   task generate: %w[
     encryption:passphrase:generate
-    keys:deploy:generate
     keys:gpg:generate
   ]
 
@@ -121,6 +112,11 @@ namespace :library do
 
   desc 'Attempt to automatically fix issues with the library'
   task fix: [:'rubocop:autocorrect_all']
+
+  desc 'Build the library'
+  task :build do
+    sh 'gem build ruby_terraform.gemspec'
+  end
 end
 
 namespace :documentation do
@@ -146,28 +142,6 @@ namespace :test do
   RSpec::Core::RakeTask.new(:unit)
 end
 
-RakeCircleCI.define_project_tasks(
-  namespace: :circle_ci,
-  project_slug: 'github/infrablocks/ruby_terraform'
-) do |t|
-  circle_ci_config =
-    YAML.load_file('config/secrets/circle_ci/config.yaml')
-
-  t.api_token = circle_ci_config['circle_ci_api_token']
-  t.environment_variables = {
-    ENCRYPTION_PASSPHRASE:
-        File.read('config/secrets/ci/encryption.passphrase')
-        .chomp
-  }
-  t.checkout_keys = []
-  t.ssh_keys = [
-    {
-      hostname: 'github.com',
-      private_key: File.read('config/secrets/ci/ssh.private')
-    }
-  ]
-end
-
 RakeGithub.define_repository_tasks(
   namespace: :github,
   repository: 'infrablocks/ruby_terraform'
@@ -176,21 +150,51 @@ RakeGithub.define_repository_tasks(
     YAML.load_file('config/secrets/github/config.yaml')
 
   t.access_token = github_config['github_personal_access_token']
-  t.deploy_keys = [
-    {
-      title: 'CircleCI',
-      public_key: File.read('config/secrets/ci/ssh.public')
-    }
+  # Actions store only: nothing in pr.yaml unlocks git-crypt, so dependabot
+  # runs never need the passphrase.
+  t.secrets = [
+    { name: 'ENCRYPTION_PASSPHRASE',
+      value: File.read('config/secrets/ci/encryption.passphrase').chomp }
+  ]
+  t.environments = [
+    { name: 'release',
+      reviewers: [{ team: 'maintainers' }] }
   ]
 end
 
+namespace :slack do
+  RakeSlack.define_notification_tasks do |t|
+    t.bot_token = ENV.fetch('SLACK_BOT_TOKEN', nil)
+    t.routing_rules = [
+      { when: { type: 'on_hold' },
+        channel: 'C038EDCRSQJ', format: :on_hold },  # release
+      { when: { actor: 'dependabot[bot]', outcome: 'success' },
+        channel: 'C03N711HVDG', format: :success },  # builds-dependabot
+      { when: { actor: 'dependabot[bot]' },
+        channel: 'C03N711HVDG', format: :failure },  # builds-dependabot
+      { when: { outcome: 'success' },
+        channel: 'C023XUE76GH', format: :success },  # builds
+      # Failures go to builds, not team-dev (org default), to keep noise
+      # out of a popular channel while this pipeline beds in.
+      { when: {},
+        channel: 'C023XUE76GH', format: :failure } # builds
+    ]
+  end
+end
+
+namespace :repository do
+  desc 'Set the git author for CI'
+  task :set_ci_author do
+    sh 'git config --global user.name "InfraBlocks CI"'
+    sh 'git config --global user.email "ci@infrablocks.io"'
+  end
+end
+
 namespace :pipeline do
-  desc 'Prepare CircleCI Pipeline'
+  desc 'Prepare GitHub Actions pipeline'
   task prepare: %i[
-    circle_ci:env_vars:ensure
-    circle_ci:checkout_keys:ensure
-    circle_ci:ssh_keys:ensure
-    github:deploy_keys:ensure
+    github:secrets:ensure
+    github:environments:ensure
   ]
 end
 
diff --git a/config/secrets/ci/ssh.private b/config/secrets/ci/ssh.private
deleted file mode 100644
index 7729c8bc..00000000
Binary files a/config/secrets/ci/ssh.private and /dev/null differ
diff --git a/config/secrets/ci/ssh.public b/config/secrets/ci/ssh.public
deleted file mode 100644
index 1df7fbfb..00000000
Binary files a/config/secrets/ci/ssh.public and /dev/null differ
diff --git a/config/secrets/circle_ci/config.yaml b/config/secrets/circle_ci/config.yaml
deleted file mode 100644
index 0f034184..00000000
Binary files a/config/secrets/circle_ci/config.yaml and /dev/null differ
diff --git a/ruby_terraform.gemspec b/ruby_terraform.gemspec
index 863e1312..64a631a2 100644
--- a/ruby_terraform.gemspec
+++ b/ruby_terraform.gemspec
@@ -47,12 +47,11 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'guard'
   spec.add_development_dependency 'guard-rspec'
   spec.add_development_dependency 'rake'
-  spec.add_development_dependency 'rake_circle_ci'
   spec.add_development_dependency 'rake_git'
   spec.add_development_dependency 'rake_git_crypt'
   spec.add_development_dependency 'rake_github'
   spec.add_development_dependency 'rake_gpg'
-  spec.add_development_dependency 'rake_ssh'
+  spec.add_development_dependency 'rake_slack'
   spec.add_development_dependency 'rspec'
   spec.add_development_dependency 'rubocop'
   spec.add_development_dependency 'rubocop-rake'
diff --git a/scripts/ci/common/configure-asdf.sh b/scripts/ci/common/configure-asdf.sh
deleted file mode 100755
index b71847a5..00000000
--- a/scripts/ci/common/configure-asdf.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-function ensure-asdf-plugin() {
-  local name="$1"
-  local repo="$2"
-
-  if ! asdf plugin list | grep -q "$name"; then
-    asdf plugin add "$name" "$repo"
-  fi
-}
-
-ensure-asdf-plugin "ruby" "https://github.com/asdf-vm/asdf-ruby.git"
-ensure-asdf-plugin "java" "https://github.com/halcyon/asdf-java.git"
-ensure-asdf-plugin "golang" "https://github.com/asdf-community/asdf-golang.git"
diff --git a/scripts/ci/common/configure-git.sh b/scripts/ci/common/configure-git.sh
deleted file mode 100755
index cb11b108..00000000
--- a/scripts/ci/common/configure-git.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-git config --global user.email "circleci@infrablocks.io"
-git config --global user.name "Circle CI"
diff --git a/scripts/ci/common/configure-rubygems.sh b/scripts/ci/common/configure-rubygems.sh
deleted file mode 100755
index 53ba65ad..00000000
--- a/scripts/ci/common/configure-rubygems.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-PROJECT_DIR="$( cd "$SCRIPT_DIR/../../.." && pwd )"
-
-cd "$PROJECT_DIR"
-
-git crypt unlock
-
-mkdir -p ~/.gem
-cp config/secrets/rubygems/credentials ~/.gem/credentials
-chmod 0600 ~/.gem/credentials
diff --git a/scripts/ci/common/install-asdf-dependencies.sh b/scripts/ci/common/install-asdf-dependencies.sh
deleted file mode 100755
index cb01457f..00000000
--- a/scripts/ci/common/install-asdf-dependencies.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-PROJECT_DIR="$( cd "$SCRIPT_DIR/../../.." && pwd )"
-
-cd "$PROJECT_DIR"
-
-asdf install
diff --git a/scripts/ci/common/install-asdf.sh b/scripts/ci/common/install-asdf.sh
deleted file mode 100755
index 8c1ce8bc..00000000
--- a/scripts/ci/common/install-asdf.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-apt-get update
-apt-get install -y --no-install-recommends \
-  ca-certificates \
-  curl \
-  git
-
-if [ ! -f "$HOME/.asdf/asdf.sh" ]; then
-  echo "Installing asdf..."
-  git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.12.0
-fi
-
-# shellcheck disable=SC2016
-echo '. "$HOME/.asdf/asdf.sh"' >> "$BASH_ENV"
diff --git a/scripts/ci/common/install-git-crypt.sh b/scripts/ci/common/install-git-crypt.sh
deleted file mode 100755
index 236276d4..00000000
--- a/scripts/ci/common/install-git-crypt.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-apt-get update
-apt-get install -y --no-install-recommends git ssh git-crypt
diff --git a/scripts/ci/common/install-gpg-key.sh b/scripts/ci/common/install-gpg-key.sh
deleted file mode 100755
index 52d10c23..00000000
--- a/scripts/ci/common/install-gpg-key.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-PROJECT_DIR="$( cd "$SCRIPT_DIR/../../.." && pwd )"
-
-cd "$PROJECT_DIR"
-
-set +e
-openssl version
-openssl aes-256-cbc \
-    -d \
-    -md sha1 \
-    -in ./.circleci/gpg.private.enc \
-    -k "${ENCRYPTION_PASSPHRASE}" | gpg --import -
-set -e
diff --git a/scripts/ci/common/install-slack-deps.sh b/scripts/ci/common/install-slack-deps.sh
deleted file mode 100755
index 70abb6b0..00000000
--- a/scripts/ci/common/install-slack-deps.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-apt-get update
-apt-get install -y --no-install-recommends curl jq
diff --git a/scripts/ci/steps/build.sh b/scripts/ci/steps/build.sh
deleted file mode 100755
index d89621c8..00000000
--- a/scripts/ci/steps/build.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-PROJECT_DIR="$( cd "$SCRIPT_DIR/../../.." && pwd )"
-
-cd "$PROJECT_DIR"
-
-./go library:check
diff --git a/scripts/ci/steps/merge-pull-request.sh b/scripts/ci/steps/merge-pull-request.sh
deleted file mode 100755
index 63be3b17..00000000
--- a/scripts/ci/steps/merge-pull-request.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-PROJECT_DIR="$( cd "$SCRIPT_DIR/../../.." && pwd )"
-
-cd "$PROJECT_DIR"
-
-git-crypt unlock
-
-CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
-
-./go github:pull_requests:merge["$CURRENT_BRANCH","%s [skip ci]"]
diff --git a/scripts/ci/steps/prerelease.sh b/scripts/ci/steps/prerelease.sh
deleted file mode 100755
index c31cf414..00000000
--- a/scripts/ci/steps/prerelease.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-PROJECT_DIR="$( cd "$SCRIPT_DIR/../../.." && pwd )"
-
-cd "$PROJECT_DIR"
-
-./go version:bump[pre]
-./go release
-
-git status
-git push
diff --git a/scripts/ci/steps/release.sh b/scripts/ci/steps/release.sh
deleted file mode 100755
index 96b160f7..00000000
--- a/scripts/ci/steps/release.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-PROJECT_DIR="$( cd "$SCRIPT_DIR/../../.." && pwd )"
-
-cd "$PROJECT_DIR"
-
-git pull
-
-./go version:bump[patch]
-./go documentation:update
-./go release
-
-git status
-git push
diff --git a/scripts/ci/steps/test.sh b/scripts/ci/steps/test.sh
deleted file mode 100755
index 0f1716ae..00000000
--- a/scripts/ci/steps/test.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-[ -n "$DEBUG" ] && set -x
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-PROJECT_DIR="$( cd "$SCRIPT_DIR/../../.." && pwd )"
-
-cd "$PROJECT_DIR"
-
-./go test:unit