diff --git a/.circle/Makefile b/.circle/Makefile
index 315c7d49..b0a10cbc 100644
--- a/.circle/Makefile
+++ b/.circle/Makefile
@@ -9,12 +9,14 @@ ST2_REPO_PATH ?= /tmp/st2
 ST2_REPO_BRANCH ?= master
 FORCE_CHECK_ALL_FILES ?= false
 FORCE_CHECK_PACK ?= false
+LINT_CONFIGS_PATH ?= $(CI_DIR)/lint-configs
+REQUIREMENTS_DIR ?= $(CI_DIR)/.circle
 
 export ST2_REPO_PATH ROOT_DIR FORCE_CHECK_ALL_FILES FORCE_CHECK_PACK
 
 # All components are prefixed by st2
-COMPONENTS := $(wildcard /tmp/st2/st2*)
-COMPONENTS_RUNNERS := $(wildcard /tmp/st2/contrib/runners/*)
+COMPONENTS := $(wildcard $(ST2_REPO_PATH)/st2*)
+COMPONENTS_RUNNERS := $(wildcard $(ST2_REPO_PATH)/contrib/runners/*)
 
 .PHONY: all
 all: requirements lint packs-resource-register packs-tests
@@ -79,14 +81,14 @@ compile:
 	if [ "$${FORCE_CHECK_ALL_FILES}" = "true" ]; then \
 		echo "Force flake8 checks on all files"; \
 		find $(ROOT_DIR)/* -name "*.py" | while read py_file; do \
-			flake8 --config=$(CI_DIR)/lint-configs/python/.flake8 $$py_file || exit 1; \
+			flake8 --config=$(LINT_CONFIGS_PATH)/python/.flake8 $$py_file || exit 1; \
 		done; \
 	elif [ ${NUM_CHANGED_PY} -gt 0 ]; then \
 		echo "Checking ${NUM_CHANGED_PY} Python files"; \
 		$(CI_DIR)/utils/git-changes py >~/.git-changes-py; \
 		while read -r file; do \
 			if [ -n "$$file" ]; then \
-				flake8 --config=$(CI_DIR)/lint-configs/python/.flake8 $$file || exit 1; \
+				flake8 --config=$(LINT_CONFIGS_PATH)/python/.flake8 $$file || exit 1; \
 			fi; \
 		done < ~/.git-changes-py; \
 		if [ -e ~/.git-changes-py ]; then rm ~/.git-changes-py; fi; \
@@ -102,11 +104,11 @@ compile:
 	. $(VIRTUALENV_DIR)/bin/activate; \
 	if [ "${COMMON_LIBS}" = "true" ]; then \
 		echo "Common libs PATH selected"; \
-		export PYTHONPATH=/home/circleci/repo/lib:${PYTHONPATH}; \
+		export PYTHONPATH=$(ROOT_DIR)/lib:${PYTHONPATH}; \
 	fi; \
 	if [ "$${FORCE_CHECK_ALL_FILES}" = "true" ] || [ ${NUM_CHANGED_PY} -gt 0 ]; then \
-		REQUIREMENTS_DIR=$(CI_DIR)/.circle/ \
-		CONFIG_DIR=$(CI_DIR)/lint-configs/ \
+		REQUIREMENTS_DIR=$(REQUIREMENTS_DIR)/ \
+		CONFIG_DIR=$(LINT_CONFIGS_PATH)/ \
 		st2-check-pylint-pack $(ROOT_DIR) || exit 1; \
 	else \
 		echo "No files have changed, skipping run..."; \
@@ -237,8 +239,8 @@ compile:
 			echo "Missing LICENSE file in $(ROOT_DIR)"; \
 			exit 2;\
 		fi;\
-		if [ "$$(python -c 'import yaml; f = open("/home/circleci/repo/pack.yaml"); print(yaml.safe_load(f.read())["name"]); f.close();')" = "napalm_logs" ] || \
-		   [ "$$(python -c 'import yaml; f = open("/home/circleci/repo/pack.yaml"); print(yaml.safe_load(f.read())["name"]); f.close();')" = "netbox" ]; then \
+		if [ "$$(python -c 'import yaml; f = open("$(ROOT_DIR)/pack.yaml"); print(yaml.safe_load(f.read())["name"]); f.close();')" = "napalm_logs" ] || \
+		   [ "$$(python -c 'import yaml; f = open("$(ROOT_DIR)/pack.yaml"); print(yaml.safe_load(f.read())["name"]); f.close();')" = "netbox" ]; then \
 			cat $(ROOT_DIR)/LICENSE | grep -q "MIT License"  || (echo "LICENSE file doesn't contain MIT license text" ; exit 2); \
 			cat $(ROOT_DIR)/LICENSE | grep -q "Copyright (c) 2017 John Anderson"  || (echo "LICENSE file doesn't include John Anderson's name" ; exit 2); \
 			cat $(ROOT_DIR)/LICENSE | grep -q "Permission is hereby granted, free of charge, to any person obtaining a copy"  || (echo "LICENSE file doesn't contain MIT license text" ; exit 2); \
@@ -252,13 +254,12 @@ compile:
 	fi
 
 .PHONY: .clone_st2_repo
-.clone_st2_repo: /tmp/st2
-/tmp/st2:
+.clone_st2_repo:
 	@echo
 	@echo "==================== cloning st2 repo ===================="
 	@echo
-	@rm -rf /tmp/st2
-	@git clone https://github.com/StackStorm/st2.git --depth 1 --single-branch --branch $(ST2_REPO_BRANCH) /tmp/st2
+	@rm -rf $(ST2_REPO_PATH)
+	@git clone https://github.com/StackStorm/st2.git --depth 1 --single-branch --branch $(ST2_REPO_BRANCH) $(ST2_REPO_PATH)
 
 .PHONY: .install-runners
 .install-runners:
@@ -284,8 +285,8 @@ requirements: virtualenv .clone_st2_repo .install-runners
 	@echo "==================== requirements ===================="
 	@echo
 	. $(VIRTUALENV_DIR)/bin/activate && $(VIRTUALENV_DIR)/bin/pip install --upgrade "pip==20.3.3"
-	. $(VIRTUALENV_DIR)/bin/activate && $(VIRTUALENV_DIR)/bin/pip install --cache-dir $(HOME)/.pip-cache -q -r $(CI_DIR)/.circle/requirements-dev.txt
-	. $(VIRTUALENV_DIR)/bin/activate && $(VIRTUALENV_DIR)/bin/pip install --cache-dir $(HOME)/.pip-cache -q -r $(CI_DIR)/.circle/requirements-pack-tests.txt
+	. $(VIRTUALENV_DIR)/bin/activate && $(VIRTUALENV_DIR)/bin/pip install --cache-dir $(HOME)/.pip-cache -q -r $(REQUIREMENTS_DIR)/requirements-dev.txt
+	. $(VIRTUALENV_DIR)/bin/activate && $(VIRTUALENV_DIR)/bin/pip install --cache-dir $(HOME)/.pip-cache -q -r $(REQUIREMENTS_DIR)/requirements-pack-tests.txt
 
 .PHONY: requirements-ci
 requirements-ci:
@@ -293,8 +294,8 @@ requirements-ci:
 	@echo "==================== requirements-ci ===================="
 	@echo
 	. $(VIRTUALENV_DIR)/bin/activate && $(VIRTUALENV_DIR)/bin/pip install --upgrade "pip==20.3.3"
-	. $(VIRTUALENV_DIR)/bin/activate && $(VIRTUALENV_DIR)/bin/pip install --cache-dir $(HOME)/.pip-cache -q -r $(CI_DIR)/.circle/requirements-dev.txt
-	. $(VIRTUALENV_DIR)/bin/activate && $(VIRTUALENV_DIR)/bin/pip install --cache-dir $(HOME)/.pip-cache -q -r $(CI_DIR)/.circle/requirements-pack-tests.txt
+	. $(VIRTUALENV_DIR)/bin/activate && $(VIRTUALENV_DIR)/bin/pip install --cache-dir $(HOME)/.pip-cache -q -r $(REQUIREMENTS_DIR)/requirements-dev.txt
+	. $(VIRTUALENV_DIR)/bin/activate && $(VIRTUALENV_DIR)/bin/pip install --cache-dir $(HOME)/.pip-cache -q -r $(REQUIREMENTS_DIR)/requirements-pack-tests.txt
 
 .PHONY: virtualenv
 virtualenv: $(VIRTUALENV_DIR)/bin/activate
diff --git a/.circle/index.py b/.circle/index.py
index 8da5756c..32c0c74c 100644
--- a/.circle/index.py
+++ b/.circle/index.py
@@ -17,11 +17,23 @@
 
 from st2common.util.pack import get_pack_ref_from_metadata
 
-EXCHANGE_NAME = "StackStorm-Exchange"
-EXCHANGE_PREFIX = "stackstorm"
+EXCHANGE_NAME = os.environ.get("PACKS_ORG", "StackStorm-Exchange")
+EXCHANGE_PREFIX = os.environ.get("PACKS_PREFIX", "stackstorm")
 
+if os.environ.get("CIRCLECI"):
+    CI = "CircleCI"
+elif os.environ.get("GITHUB_ACTIONS"):
+    CI = "GHA"
+else:
+    CI = "unknown"
+
+
+# TODO: drop GITHUB_USERNAME once we drop support for CircleCI
 GITHUB_USERNAME = os.environ.get('MACHINE_USER')
+# TODO: drop MACHINE_PASSWORD once we drop support for CircleCI. Keep GH_TOKEN.
 GITHUB_PASSWORD = os.environ.get("MACHINE_PASSWORD", os.environ.get("GH_TOKEN"))
+# TODO: drop ACTIVE_PACK_NAME once we drop support for CircleCI.
+#       Only used for CircleCI-specific error message.
 ACTIVE_PACK_NAME = os.environ.get('PACK_NAME', "unknown")
 
 SESSION = requests.Session()
@@ -63,7 +75,7 @@ def build_index(path_glob, output_path):
     counter = 0
     failed_count = 0
     for filename in generator:
-        with open(filename, 'r') as pack:
+        with open(filename, 'r', encoding="utf8") as pack:
             pack_meta = yaml.safe_load(pack)
 
         pack_name = pack_meta['name']
@@ -102,12 +114,13 @@ def build_index(path_glob, output_path):
     result['metadata']['hash'] = data_hash.hexdigest()
 
     output_path = os.path.expanduser(os.path.join(output_path, 'index.json'))
-    with open(output_path, 'w') as outfile:
+    with open(output_path, 'w', encoding="utf8") as outfile:
         json.dump(result, outfile, indent=4, sort_keys=True,
                   separators=(',', ': '))
 
     failed_message = ''
-    if failed_count > 0:
+    # TODO: drop CircleCI error message once we drop support for CircleCI
+    if failed_count > 0 and CI == "CircleCI":
         failed_message = (
             ', {failed_count} packs failed to update.\n'
             'The GitHub Personal Access Tokens for CircleCI for the pack may '
@@ -120,6 +133,14 @@ def build_index(path_glob, output_path):
             'will need to ask a member of the StackStorm TSC to update the Personal\n'
             'Access Token on your behalf.'
         ).format(failed_count=failed_count, exchange_name=EXCHANGE_NAME)
+    elif failed_count > 0:
+        # If an issue is reported on GitHub Actions, update this error message
+        # to explain common causes and how to fix them.
+        failed_message = (
+            f', {failed_count} packs failed to update.\n'
+            'Please investigate why this failed and report an issue on:\n'
+            f'  https://github.com/{EXCHANGE_NAME}/ci\n'
+        )
 
     print('')
     print('Processed %s packs%s.' % (counter, failed_message))
@@ -152,13 +173,20 @@ def get_available_versions():
         proc.kill()
         outs, _ = proc.communicate()
     result = outs.decode().strip()
-    if proc.returncode != 0:
+    # TODO: drop CircleCI error message once we drop support for CircleCI
+    if proc.returncode != 0 and CI == "CircleCI":
         sys.exit(
             "Error retrieving data with github graphql API.\n"
             "The GitHub PAT might need to be regenerated:\n"
             "https://github.com/settings/tokens/new?scopes=public_repo"
             "&description=CircleCI%3A%20stackstorm-" + ACTIVE_PACK_NAME
         )
+    elif proc.returncode != 0:
+        # If an issue is reported on GitHub Actions, update this error message
+        # to explain common causes and how to fix them.
+        sys.exit(
+            "Error retrieving data with github graphql API.\n"
+        )
 
     # https://stackoverflow.com/a/43807246/1134951
     decoder = json.JSONDecoder()
@@ -194,7 +222,12 @@ def get_available_versions_for_pack(pack_ref):
 
     NOTE: This function uses Github API.
     """
+    # TODO: remove this if block once we discontinue CircleCI support. Keep the else block.
     if pack_ref not in PACK_VERSIONS:
+        # This will fail in GitHub Actions because the GITHUB_TOKEN there must be
+        # provided as bearer auth instead of basic auth. But using graphql is better
+        # anyway, so this is only needed as a backup on CircleCI if graphql doesn't work.
+        # graphql should always work on GHA.
         url = ('https://api.github.com/repos/%s/%s-%s/tags' %
                (EXCHANGE_NAME, EXCHANGE_PREFIX, pack_ref))
         resp = SESSION.get(url)
diff --git a/.circle/semver.py b/.circle/semver.py
index 546bf639..0dc86fb1 100644
--- a/.circle/semver.py
+++ b/.circle/semver.py
@@ -16,8 +16,7 @@
 
 import sys
 import re
-
-import validate
+import yaml
 
 SEMVER_REGEX = re.compile(r"""^(?:0|[1-9]\d*)
                               \.
@@ -31,6 +30,13 @@
 DOUBLE_VERSION_REGEX = re.compile(r"^\d+\.\d+$")
 
 
+def load_yaml_file(path):
+    with open(path, 'r', encoding="utf8") as stream:
+        text = yaml.safe_load(stream)
+
+    return text
+
+
 def get_semver_string(version):
     if SINGLE_VERSION_REGEX.match(str(version)):
         semver = "%s.0.0" % version
@@ -44,5 +50,5 @@ def get_semver_string(version):
 
 
 if __name__ == '__main__':
-    pack = validate.load_yaml_file(sys.argv[1])
+    pack = load_yaml_file(sys.argv[1])
     print(get_semver_string(pack['version']))
diff --git a/.circle/validate.py b/.circle/validate.py
index 7d30ce16..65df7915 100644
--- a/.circle/validate.py
+++ b/.circle/validate.py
@@ -14,6 +14,7 @@
 # limitations under the License.
 from __future__ import print_function
 
+import os
 import sys
 
 import yaml
@@ -22,18 +23,21 @@
 from st2common.util import schema as util_schema
 from st2common.util.pack import get_pack_ref_from_metadata
 
-PREFIX = 'stackstorm'
+PREFIX = os.environ.get("PACKS_PREFIX", "stackstorm")
 PACK_SCHEMA = PackAPI.schema
 
 
 def load_yaml_file(path):
-    with open(path, 'r') as stream:
+    with open(path, 'r', encoding="utf8") as stream:
         text = yaml.safe_load(stream)
 
     return text
 
 
 def validate_schema(instance, schema):
+    # validate() returns a cleaned instance with default values assigned.
+    # and it calls jsonschema.validate(instance, schema) so this will
+    # raise ValidationError if instance is not valid according to schema
     return util_schema.validate(instance=instance, schema=schema,
                                 cls=util_schema.CustomValidator,
                                 use_default=True,
@@ -51,12 +55,22 @@ def validate_repo_name(instance, repo_name):
 
 
 if __name__ == '__main__':
+    # If an exception is raised, python basically does sys.exit(1)
+    # Without an exception, the return code is 0.
+
     repo_name = sys.argv[1]
+    # raises if yaml is invalid
     pack_meta = load_yaml_file(sys.argv[2])
 
     # TODO: Figure out why this wasn't previously executed, and execute it
+    #       stackstorm-test-content-version repo is test_content_version pack
+    #       stackstorm-test2 repo is test pack
     # validate_repo_name(pack_meta, repo_name)
-    validate_schema(pack_meta, PACK_SCHEMA)
+
+    # raises ValidationError if pack_meta doesn't validate against PACK_SCHEMA
+    cleaned_pack_meta = validate_schema(pack_meta, PACK_SCHEMA)
+
+    # raises ValueError if pack ref not defined and pack name is not a valid ref
     pack_ref = validate_pack_contains_valid_ref_or_name(pack_meta)
 
     print(pack_ref)
diff --git a/.github/actions/apt-dependencies/action.yaml b/.github/actions/apt-dependencies/action.yaml
new file mode 100644
index 00000000..69bccf86
--- /dev/null
+++ b/.github/actions/apt-dependencies/action.yaml
@@ -0,0 +1,72 @@
+---
+name: Install APT Dependencies
+description: |
+  Install debian dependencies required for StackStorm-Exchange pack tests.
+  Before using this, make sure to run
+  StackStorm-Exchange/ci/.github/actions/checkout.
+author: StackStorm
+
+inputs:
+  cache-version:
+    required: false
+    default: "v0"
+  extra-apt-packages-file:
+    required: false
+    default: pack/.github/apt-packages.txt
+
+runs:
+  using: "composite"
+  steps:
+
+    # TODO: not working on GHA. Need to revisit caching.
+    #- name: Create a directory for debian packages so we can cache it
+    #  # this is what we did on CircleCI. Not sure if it'll work on GHA
+    #  shell: bash
+    #  run: >
+    #    sudo rm -rf /var/cache/apt/archives /var/lib/apt/lists
+    #    && sudo ln -s ~/apt_cache/archives /var/cache/apt/archives
+    #    && sudo ln -s ~/apt_cache/lists /var/lib/apt/lists
+    #    && mkdir -p ~/apt_cache/archives/partial ~/apt_cache/lists
+
+    # hashFiles only reads files relative to GITHUB_WORKSPACE
+    - name: Construct apt-packages.txt
+      shell: bash
+      run: |
+        cp ${{ github.action_path }}/apt-packages.txt ${GITHUB_WORKSPACE}/
+        if [[ -f ${{ inputs.extra-apt-packages-file }} ]]; then
+          cat ${{ inputs.extra-apt-packages-file }} >> ${GITHUB_WORKSPACE}/apt-packages.txt
+        fi
+
+    #- name: Cache APT Dependencies
+    #  id: cache-apt-deps
+    #  uses: actions/cache@v2
+    #  with:
+    #    path: |
+    #      ~/apt_cache/*.deb
+    #    key: ${{ inputs.cache-version }}-apt-archives-and-lists-${{ hashFiles('apt-packages.txt') }}
+    #    restore-keys: |
+    #      ${{ inputs.cache-version }}-apt-archives-and-lists-
+
+    - name: Install APT Dependencies
+      shell: bash
+      env:
+    #    CACHE_HIT: ${{steps.cache-apt-deps.outputs.cache-hit}}
+        CACHE_HIT: "false"
+        APT_PACKAGES_FILE_PATH: apt-packages.txt
+        DEBIAN_FRONTEND: noninteractive
+      run: |
+        echo "::group::Install APT Dependencies"
+        if [[ "${CACHE_HIT}" != 'true' ]]; then
+          sudo apt-get -o=Dpkg::Use-Pty=0 -yq update
+        fi
+        APT_PACKAGES=$(grep -v '^#' "${APT_PACKAGES_FILE_PATH}" | xargs echo -n)
+        sudo apt-get -o=Dpkg::Use-Pty=0 -yq install ${APT_PACKAGES}
+        echo "::endgroup::"
+
+    - name: Print versions
+      shell: bash
+      run: |
+        echo "::group::Print Versions"
+        jq --version
+        gh --version
+        echo "::endgroup::"
diff --git a/.github/actions/apt-dependencies/apt-packages.txt b/.github/actions/apt-dependencies/apt-packages.txt
new file mode 100644
index 00000000..68ad6cea
--- /dev/null
+++ b/.github/actions/apt-dependencies/apt-packages.txt
@@ -0,0 +1,10 @@
+# pre-installed on GHA
+#jq
+#gh # github cli
+#imagemagick
+
+# for st2 pip build
+libldap2-dev
+libsasl2-dev
+# st2 also installs
+#libssl-dev libyaml-dev ldap-utils
diff --git a/.github/actions/apt-dependencies/index-apt-packages.txt b/.github/actions/apt-dependencies/index-apt-packages.txt
new file mode 100644
index 00000000..1d292afd
--- /dev/null
+++ b/.github/actions/apt-dependencies/index-apt-packages.txt
@@ -0,0 +1,5 @@
+# In CircleCI, we couldn't directly install imagemagick, so
+# we used a workaround from https://discuss.circleci.com/t/error-installing-imagemagick/2963
+# TODO: determine if we should go back to using imagemagick instead of gmic and optipng
+gmic
+optipng
diff --git a/.github/actions/checkout/action.yaml b/.github/actions/checkout/action.yaml
new file mode 100644
index 00000000..2eee7fb6
--- /dev/null
+++ b/.github/actions/checkout/action.yaml
@@ -0,0 +1,64 @@
+---
+name: Checkout Pack Repo and CI Repos
+description: |
+  Configures git user and clones repositories
+  required for StackStorm-Exchange pack tests.
+author: StackStorm
+
+inputs:
+  git_user_name:
+    required: false
+    default: "StackStorm Exchange"
+  git_user_email:
+    required: false
+    default: "info@stackstorm.com"
+  st2_branch:
+    required: false
+    default: master
+  lint_configs_branch:
+    required: false
+    default: master
+
+runs:
+  using: "composite"
+  steps:
+
+    - name: Add checkout paths to env context
+      shell: bash
+      run: |
+        echo "ST2_REPO_PATH=${{ github.workspace }}/st2" >> ${GITHUB_ENV}
+        echo "ROOT_DIR=${{ github.workspace }}/pack" >> ${GITHUB_ENV}
+        echo "CI_DIR=$(realpath ${{ github.action_path }}/../../..)" >> ${GITHUB_ENV}
+        echo "LINT_CONFIGS_PATH=${{ github.workspace }}/lint-configs" >> ${GITHUB_ENV}
+
+    - name: Configure git user
+      shell: bash
+      env:
+        GIT_USER_NAME: "${{ inputs.git_user_name }}"
+        GIT_USER_EMAIL: "${{ inputs.git_user_email }}"
+      run: |
+        git config --global user.name "${GIT_USER_NAME}"
+        git config --global user.email "${GIT_USER_EMAIL}"
+
+    - name: Checkout pack repo
+      uses: actions/checkout@v2
+      with:
+        path: pack
+        fetch-depth: 0
+
+    - name: Checkout st2 repo
+      # so other scripts can reference StackStorm Python code
+      uses: actions/checkout@v2
+      with:
+        repository: StackStorm/st2
+        ref: ${{ inputs.st2_branch }}
+        path: st2
+        fetch-depth: 1
+
+    - name: Checkout lint-configs repo
+      uses: actions/checkout@v2
+      with:
+        repository: StackStorm/lint-configs
+        ref: ${{ inputs.lint_configs_branch }}
+        path: lint-configs
+        fetch-depth: 1
diff --git a/.github/actions/py-dependencies/action.yaml b/.github/actions/py-dependencies/action.yaml
new file mode 100644
index 00000000..63e526a3
--- /dev/null
+++ b/.github/actions/py-dependencies/action.yaml
@@ -0,0 +1,139 @@
+---
+name: Install Python Dependencies
+description: |
+  Install python dependencies required for StackStorm-Exchange pack tests or index updates.
+  Before using this, make sure to run
+  StackStorm-Exchange/ci/.github/actions/checkout and
+  StackStorm-Exchange/ci/.github/actions/apt-dependencies.
+author: StackStorm
+
+inputs:
+  python-version:
+    required: true
+    description: Which python version we should install
+  cache-version:
+    required: false
+    default: "v0"
+  mode:
+    required: false
+    default: pack
+    options:
+      - index
+      - pack
+
+outputs:
+  pip-version:
+    description: The installed pip version (pulled from st2.git)
+    value: ${{ steps.virtualenv.outputs.pip-version }}
+
+runs:
+  using: "composite"
+  steps:
+
+    - name: Add VIRTUALENV_DIR to env context
+      shell: bash
+      run: |
+        echo "VIRTUALENV_DIR=${HOME}/virtualenv" >> ${GITHUB_ENV}
+        echo "REQUIREMENTS_DIR=${GITHUB_ACTION_PATH}" >> ${GITHUB_ENV}
+
+    - name: 'Set up Python (${{ inputs.python-version }})'
+      uses: actions/setup-python@v2
+      with:
+        python-version: '${{ inputs.python-version }}'
+
+    - name: Cache Python Dependencies
+      uses: actions/cache@v2
+      with:
+        path: |
+          ~/.cache/pip
+          ~/virtualenv
+        key: ${{ runner.os }}-python-${{ inputs.python-version }}-${{ inputs.cache-version }}-${{ hashFiles('st2/requirements.txt', 'pack/requirements*.txt') }}
+        restore-keys: |
+          ${{ runner.os }}-python-${{ inputs.python-version }}-${{ inputs.cache-version }}-
+
+    - name: Install virtualenv command
+      shell: bash
+      # this should run in the st2 checkout
+      working-directory: st2
+      run: |
+        echo "::group::Install virtualenv command"
+        ./scripts/github/install-virtualenv.sh
+        echo "::endgroup::"
+
+    - name: Create ~/virtualenv
+      shell: bash
+      id: virtualenv
+      # this should run in the st2 checkout
+      working-directory: st2
+      run: |
+        echo "::group::Create ~/virtualenv"
+        PIP_VERSION=$(grep '^PIP_VERSION' Makefile | awk '{print $3}')
+        echo "::set-output name=pip-version::${PIP_VERSION}"
+        [[ -x "${VIRTUALENV_DIR}/bin/python" ]] || virtualenv --pip "${PIP_VERSION}" ~/virtualenv
+        ${VIRTUALENV_DIR}/bin/pip install -q -U "pip==${PIP_VERSION}" setuptools
+        echo "::endgroup::"
+
+    - name: Install CI Requirements
+      if: inputs.mode == 'pack'
+      shell: bash
+      run: |
+        echo "::group::Install CI Requirements"
+        ${VIRTUALENV_DIR}/bin/pip install -q -r ${REQUIREMENTS_DIR}/requirements-dev.txt
+        ${VIRTUALENV_DIR}/bin/pip install -q -r ${REQUIREMENTS_DIR}/requirements-pack-tests.txt
+        echo "::endgroup::"
+
+    - name: Install StackStorm Requirements
+      # this should run in the st2 checkout
+      shell: bash
+      working-directory: st2
+      run: |
+        echo "::group::Install StackStorm Requirements"
+        ${VIRTUALENV_DIR}/bin/pip install -q -r requirements.txt
+        echo "::endgroup::"
+
+    - name: Install Runners
+      if: inputs.mode == 'pack'
+      shell: bash
+      run: |
+        for runner in ${ST2_REPO_PATH}/contrib/runners/*; do
+          echo "::group::Install Runner: ${runner##*/}"
+          (. ${VIRTUALENV_DIR}/bin/activate; cd $runner; python setup.py develop)
+          echo "::endgroup::"
+        done
+
+    - name: Register Metrics Drivers
+      shell: bash
+      run: |
+        echo "::group::Register Metrics Drivers"
+        # Install st2common to register metrics drivers
+        (. ${VIRTUALENV_DIR}/bin/activate; cd ${ST2_REPO_PATH}/st2common; python setup.py develop)
+        echo "::endgroup::"
+
+    - name: Install Pack Requirements
+      if: inputs.mode == 'pack'
+      shell: bash
+      working-directory: pack
+      env:
+        PACK_REQUIREMENTS_FILE: requirements.txt
+        PACK_TESTS_REQUIREMENTS_FILE: requirements-tests.txt
+      run: |
+        echo "::group::Install Pack Requirements"
+        if [[ -f "${PACK_REQUIREMENTS_FILE}" ]]; then
+          echo "Installing pack requirements from ${PACK_REQUIREMENTS_FILE}"
+          ${VIRTUALENV_DIR}/bin/pip install -r "${PACK_REQUIREMENTS_FILE}"
+        fi
+        if [[ -f "${PACK_TESTS_REQUIREMENTS_FILE}" ]]; then
+          echo "Installing pack tests requirements from ${PACK_TESTS_REQUIREMENTS_FILE}"
+          ${VIRTUALENV_DIR}/bin/pip install -r "${PACK_TESTS_REQUIREMENTS_FILE}"
+        fi
+        echo "::endgroup::"
+
+    - name: Print Versions
+      shell: bash
+      run: |
+        echo "::group::Print Versions"
+        source ${VIRTUALENV_DIR}/bin/activate
+        python3 --version
+        pip --version
+        virtualenv --version
+        echo "::endgroup::"
diff --git a/.github/actions/py-dependencies/requirements-ci-ci.txt b/.github/actions/py-dependencies/requirements-ci-ci.txt
new file mode 100644
index 00000000..d6fdb7ee
--- /dev/null
+++ b/.github/actions/py-dependencies/requirements-ci-ci.txt
@@ -0,0 +1,4 @@
+flake8
+pylint
+pyyaml
+requests
diff --git a/.github/actions/py-dependencies/requirements-dev.txt b/.github/actions/py-dependencies/requirements-dev.txt
new file mode 100644
index 00000000..294650d7
--- /dev/null
+++ b/.github/actions/py-dependencies/requirements-dev.txt
@@ -0,0 +1,9 @@
+# Needed for chek and lint scripts
+-e git+https://github.com/StackStorm/st2sdk.git@master#egg=st2sdk
+pyyaml
+pep8>=1.6.0,<1.7
+flake8==3.7.7
+astroid==1.6.5
+pylint==1.9.4
+# fix isort dependency of pylint 1.9.4 by keeping it below its 5.x version
+isort>=4.2.5,<5
diff --git a/.github/actions/py-dependencies/requirements-pack-tests.txt b/.github/actions/py-dependencies/requirements-pack-tests.txt
new file mode 100644
index 00000000..84bf40d6
--- /dev/null
+++ b/.github/actions/py-dependencies/requirements-pack-tests.txt
@@ -0,0 +1,5 @@
+mock>=1.3.0,<2.1
+unittest2>=1.1.0,<2.0
+nose>=1.3.7
+# temporary workaround for travis issue
+eventlet==0.19.0
diff --git a/.github/actions/py-dependencies/requirements.txt b/.github/actions/py-dependencies/requirements.txt
new file mode 100644
index 00000000..2c438f9d
--- /dev/null
+++ b/.github/actions/py-dependencies/requirements.txt
@@ -0,0 +1,3 @@
+jsonschema==2.5.1
+pyyaml==4.2b1
+requests[security]==2.21.0
diff --git a/.github/actions/repo-meta/action.yaml b/.github/actions/repo-meta/action.yaml
new file mode 100644
index 00000000..8e3c56e8
--- /dev/null
+++ b/.github/actions/repo-meta/action.yaml
@@ -0,0 +1,70 @@
+---
+name: Update Pack Repo Metadata
+description: |
+  Update Pack Repo Metadata based on pack.yaml.
+  You must clone the pack to the default location
+  and install python before running this.
+author: StackStorm
+
+inputs:
+  homepage:
+    required: false
+    # env vars are available here (see Update repo homepage task)
+    default: "https://exchange.stackstorm.com/#${PACK_NAME}"
+
+outputs:
+  pack_description:
+    description: The current pack description according to pack.yaml
+    value: ${{ env.PACK_DESCRIPTION }}
+  repo_homepage:
+    description: The resulting repo homepage
+    value: ${{ inputs.homepage }}
+  original_description:
+    description: The original description before running this workflow
+    value: ${{ env.ORIGINAL_DESCRIPTION }}
+  original_homepage:
+    description: The original homepage before running this workflow
+    value: ${{ env.ORIGINAL_HOMEPAGE }}
+  updated:
+    description: true if metadata was updated on the pack repo
+    # skipped if task did not run
+    value: ${{ steps.gh-description.conclusion == 'success' || steps.gh-homepage.conclusion == 'success' }}
+
+runs:
+  using: "composite"
+  steps:
+
+    - name: Install extract.py deps
+      shell: bash
+      run: |
+        pip install --user pyyaml
+
+    - name: Get metadata from pack.yaml
+      shell: bash
+      run: |
+        PACK_NAME=$(python ${GITHUB_ACTION_PATH}/extract.py pack.yaml name)
+        echo "PACK_NAME=${PACK_NAME}" | tee -a ${GITHUB_ENV}
+        PACK_DESCRIPTION=$(python ${GITHUB_ACTION_PATH}/extract.py pack.yaml description)
+        echo "PACK_DESCRIPTION=${PACK_DESCRIPTION}" | tee -a ${GITHUB_ENV}
+
+    - name: Get latest repo metadata
+      shell: bash
+      run: |
+        ORIGINAL_DESCRIPTION=$(gh repo view --json description -q .description)
+        echo "ORIGINAL_DESCRIPTION=${ORIGINAL_DESCRIPTION}" | tee -a ${GITHUB_ENV}
+        ORIGINAL_HOMEPAGE=$(gh repo view --json homepage -q .homepage)
+        echo "ORIGINAL_HOMEPAGE=${ORIGINAL_HOMEPAGE}" | tee -a ${GITHUB_ENV}
+
+    - name: Update repo description
+      id: gh-description
+      if:  ${{ env.ORIGINAL_DESCRIPTION != env.PACK_DESCRIPTION && env.PACK_DESCRIPTION != '' }}
+      shell: bash
+      run: |
+        gh api -X PATCH 'repos/{owner}/{repo}' -f "description=${PACK_DESCRIPTION}"
+
+    - name: Update repo homepage
+      id: gh-homepage
+      if:  ${{ env.ORIGINAL_HOMEPAGE != inputs.homepage && inputs.homepage != '' }}
+      shell: bash
+      run: |
+        gh api -X PATCH 'repos/{owner}/{repo}' -f "homepage=${{ inputs.homepage }}"
diff --git a/.github/actions/repo-meta/extract.py b/.github/actions/repo-meta/extract.py
new file mode 100644
index 00000000..8ac1a91c
--- /dev/null
+++ b/.github/actions/repo-meta/extract.py
@@ -0,0 +1,42 @@
+# Licensed to the StackStorm, Inc ('StackStorm') under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+from __future__ import print_function
+
+import json
+import sys
+import typing
+
+import yaml
+
+
+def load_yaml_file(path):
+    with open(path, "r", encoding="utf8") as stream:
+        text = yaml.safe_load(stream)
+
+    return text
+
+
+def dump(value):
+    if isinstance(value, typing.Collection):
+        value = json.dumps(value)
+    # else it is a simple int or str (pass as is w/o json quotes)
+    return value
+
+
+if __name__ == "__main__":
+    pack = load_yaml_file(sys.argv[1])
+    key = sys.argv[2]
+    value = pack.get(key, "")
+    print(dump(value))
diff --git a/.github/actions/tag/action.yaml b/.github/actions/tag/action.yaml
new file mode 100644
index 00000000..d3be5e74
--- /dev/null
+++ b/.github/actions/tag/action.yaml
@@ -0,0 +1,69 @@
+---
+name: Tag Pack Repo
+description: |
+  Tag Pack Repo with semver style tag using the version in pack.yaml.
+  You must clone the pack to the default location (fetch-depth: 0)
+  and install python before running this.
+author: StackStorm
+
+outputs:
+  pack_version:
+    description: The current pack version according to pack.yaml
+    value: ${{ env.PACK_VERSION }}
+  previous_tag:
+    description: The latest tag before running this workflow
+    value: ${{ env.LATEST_TAG }}
+  created_tag:
+    description: true if a new tag was pushed to the pack repo
+    # skipped if task did not run
+    value: ${{ steps.git-tag.conclusion == 'success' }}
+
+runs:
+  using: "composite"
+  steps:
+
+    - name: Add checkout path to env context
+      shell: bash
+      run: |
+        echo "CI_DIR=$(realpath ${{ github.action_path }}/../../..)" >> ${GITHUB_ENV}
+
+    - name: Install semver.py deps
+      shell: bash
+      run: |
+        pip install --user pyyaml
+
+    - name: Get version from pack.yaml
+      shell: bash
+      run: |
+        PACK_VERSION=$(python ${CI_DIR}/.circle/semver.py pack.yaml)
+        echo "PACK_VERSION=${PACK_VERSION}" | tee -a ${GITHUB_ENV}
+
+    - name: Get latest git tag
+      shell: bash
+      run: |
+        if LATEST_TAG=$(git describe --tags `git rev-list --tags --max-count=1`); then
+          echo "LATEST_TAG=${LATEST_TAG}" | tee -a ${GITHUB_ENV}
+        else
+          echo 'LATEST_TAG=""' >> ${GITHUB_ENV}
+          echo There are no tags yet.
+        fi
+
+    - name: Tag HEAD commit if pack.yaml version has changed
+      id: git-tag
+      if:  ${{ env.LATEST_TAG != format('v{0}', env.PACK_VERSION) && env.PACK_VERSION != '' }}
+      shell: bash
+      run: |
+        echo "::group::create v${PACK_VERSION} tag on HEAD"
+        set -x
+        git tag "v${PACK_VERSION}" HEAD
+        set +x
+        echo "::endgroup::"
+        echo "::group::Display details about tags"
+        set -x
+        git tag
+        git log --pretty='%h %d' --max-count=1
+        set +x
+        echo "::endgroup::"
+        echo "::group::push v${PACK_VERSION} tag"
+        git push origin "v${PACK_VERSION}"
+        echo "::endgroup::"
diff --git a/.github/actions/test/action.yaml b/.github/actions/test/action.yaml
new file mode 100644
index 00000000..74248fb0
--- /dev/null
+++ b/.github/actions/test/action.yaml
@@ -0,0 +1,69 @@
+---
+name: Run pack tests
+description: |
+  Run StackStorm-Exchange pack tests.
+  Before using this, make sure to run
+  StackStorm-Exchange/ci/.github/actions/checkout,
+  StackStorm-Exchange/ci/.github/actions/apt-dependencies, and
+  StackStorm-Exchange/ci/.github/actions/py-dependencies.
+author: StackStorm
+
+inputs:
+  enable-common-libs:
+    description: |
+      When true, use an st2.conf that sets packs.enable_common_libs=true
+      see: https://docs.stackstorm.com/reference/sharing_code_sensors_actions.html
+    default: false
+    required: false
+outputs:
+  pack-name:
+    description: The pack name pulled from pack.yaml
+    value: ${{ steps.pack-name.outputs.pack-name }}
+
+runs:
+  using: "composite"
+  steps:
+
+    - name: Get Pack Name
+      id: pack-name
+      shell: bash
+      working-directory: pack
+      run: |
+        export PACK_NAME=$(${VIRTUALENV_DIR}/bin/python ${CI_DIR}/.circle/validate.py "${GITHUB_REPOSITORY##*/}" pack.yaml)
+        if [[ -z "${PACK_NAME}" ]]; then
+          echo "Unable to retrieve pack name."
+          exit 1
+        fi
+        echo "::set-output name=pack-name::${PACK_NAME}"
+
+    - name: Add CI vars to env context
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      working-directory: pack
+      run: |
+        echo "PACK_NAME=${{ steps.pack-name.outputs.pack-name }}" >> ${GITHUB_ENV}
+        source ${CI_DIR}/tools/functions.sh
+        DEFAULT_BRANCH=$(_gh_default_branch)
+        echo "BASE_BRANCH=origin/${DEFAULT_BRANCH}" >> ${GITHUB_ENV}
+        if [[ "${DEFAULT_BRANCH}" == "${GITHUB_REF_NAME}" ]]; then
+          echo "FORCE_CHECK_ALL_FILES=true" >> ${GITHUB_ENV}
+        fi
+        if [[ "true" == "${{ inputs.enable-common-libs }}" ]]; then
+          echo "Common libs PATH selected"
+          echo "ST2_CONFIG_FILE=${CI_DIR}/conf/st2_common_libs.tests.conf" >> ${GITHUB_ENV}
+        else
+          echo "ST2_CONFIG_FILE=${CI_DIR}/conf/st2.tests.conf" >> ${GITHUB_ENV}
+        fi
+        # Don't install various StackStorm dependencies which are already
+        # installed by CI again in the various check scripts
+        echo "ST2_INSTALL_DEPS=0" >> ${GITHUB_ENV}
+
+    - name: Run tests
+      shell: bash
+      # NB: This Makefile has CircleCI-based defaults which we override with env vars
+      # defined in the various composite actions.
+      run: |
+        source ${VIRTUALENV_DIR}/bin/activate
+        # NB: tests require services (mongo, rabbitmq) which must be defined by the calling workflow
+        make -C "${ROOT_DIR}" -f "${CI_DIR}/.circle/Makefile" all-ci
diff --git a/.github/workflows/index-update.yaml b/.github/workflows/index-update.yaml
new file mode 100644
index 00000000..191fdc47
--- /dev/null
+++ b/.github/workflows/index-update.yaml
@@ -0,0 +1,253 @@
+name: Index Update
+
+on:
+  workflow_call:
+    inputs:
+      force-rebuild-index:
+        required: false
+        type: boolean
+        default: false
+      git_user_name:
+        required: false
+        type: string
+        default: "StackStorm Exchange"
+      git_user_email:
+        required: false
+        type: string
+        default: "info@stackstorm.com"
+      ci_branch:
+        required: false
+        type: string
+        default: master
+      exchange_tools_branch:
+        required: false
+        type: string
+        default: master
+      packs_org:
+        required: false
+        type: string
+        default: StackStorm-Exchange
+      pack_repo_prefix:
+        required: false
+        type: string
+        default: stackstorm
+      apt-cache-version:
+        required: false
+        type: string
+        default: "v0"
+      py-cache-version:
+        required: false
+        type: string
+        default: "v0"
+      python-version:
+        required: false
+        type: string
+        default: "3.6"
+
+jobs:
+  regenerate_index:
+    runs-on: ubuntu-latest
+    # When parent workflow is named "Update Index" this shows up as:
+    #   "Update Index / Regenerate"
+    name: Regenerate
+
+    steps:
+
+    - name: Add checkout paths to env context
+      shell: bash
+      run: |
+        echo "CI_DIR=${{ github.workspace }}/ci" >> ${GITHUB_ENV}
+        echo "TOOLS_DIR=${{ github.workspace }}/exchange-tools" >> ${GITHUB_ENV}
+        echo "ST2_REPO_PATH=${{ github.workspace }}/st2" >> ${GITHUB_ENV}
+        echo "INDEX_DIR=${{ github.workspace }}/index" >> ${GITHUB_ENV}
+        echo "PACKS_PATH=${{ github.workspace }}/packs" >> ${GITHUB_ENV}
+
+    - name: Configure git user
+      shell: bash
+      env:
+        GIT_USER_NAME: ${{ inputs.git_user_name }}
+        GIT_USER_EMAIL: ${{ inputs.git_user_email }}
+      run: |
+        git config --global user.name "${GIT_USER_NAME}"
+        git config --global user.email "${GIT_USER_EMAIL}"
+
+    - name: Checkout index repo
+      uses: actions/checkout@v2
+      with:
+        path: index
+        fetch-depth: 1
+
+    - name: Checkout ci repo
+      uses: actions/checkout@v2
+      with:
+        repository: StackStorm-Exchange/ci
+        ref: ${{ inputs.ci_branch }}
+        path: ci
+        fetch-depth: 1
+
+    - name: Checkout exchange-tools repo
+      uses: actions/checkout@v2
+      with:
+        repository: StackStorm-Exchange/exchange-tools
+        ref: ${{ inputs.exchange_tools_branch }}
+        path: exchange-tools
+        fetch-depth: 1
+
+    - name: Checkout st2 repo
+      # so other scripts can reference StackStorm Python code
+      uses: actions/checkout@v2
+      with:
+        repository: StackStorm/st2
+        ref: ${{ inputs.st2_branch }}
+        path: st2
+        fetch-depth: 1
+
+    - name: Install APT Dependencies
+      uses: StackStorm-Exchange/ci/.github/actions/apt-dependencies@master
+      with:
+        cache-version: ${{ inputs.apt-cache-version }}
+        # this has dependencies for icon optimization
+        extra-apt-packages-file: ci/.github/actions/apt-dependencies/index-apt-packages.txt
+
+    - name: Install Python Dependencies
+      uses: StackStorm-Exchange/ci/.github/actions/py-dependencies@master
+      with:
+        mode: index # ie: skip pack-specific deps
+        cache-version: ${{ inputs.py-cache-version }}
+        python-version: ${{ inputs.python-version }}
+
+    - name: Checkout Pack Repos
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        PACKS_ORG: ${{ inputs.packs_org }}
+        PACKS_PREFIX: ${{ inputs.pack_repo_prefix }}
+      run: |
+        mkdir -p ${PACKS_PATH}
+        cd ${PACKS_PATH}
+        source ${TOOLS_DIR}/functions.sh
+        EXCLUDE_PACKS=$(grep -v '^#' "${INDEX_DIR}/v1/exclude_packs.txt" | xargs echo -n)
+        for repo_name in $(_gh_list_repo_names ${PACKS_ORG} ${PACKS_PREFIX}); do
+          echo "::group::Clone ${PACKS_ORG}/${repo_name}"
+          gh repo clone "${PACKS_ORG}/${repo_name}"
+          if latestTag=$(git -C ${repo_name} describe --tags `git -C ${repo_name} rev-list --tags --max-count=1`); then
+            echo latestTag = $latestTag
+            git -C ${repo_name} checkout $latestTag -b latestTagBranch
+          fi
+          echo
+          echo "::endgroup::" # DELETED notices will not be folded to simplify scanning action output
+          if [[ -z "$latestTag" ]]; then
+            rm -rf ${repo_name}
+            echo "DELETED clone of ${PACKS_ORG}/${repo_name}: missing git tags"
+            echo "${PACKS_ORG}/${repo_name}" >> ${GITHUB_WORKSPACE}/bad_pack_repos
+          elif [[ ! -f "./${repo_name}/pack.yaml" ]]; then
+            rm -rf ${repo_name}
+            echo "DELETED clone of ${PACKS_ORG}/${repo_name}: missing pack.yaml"
+            echo "${PACKS_ORG}/${repo_name}" >> ${GITHUB_WORKSPACE}/bad_pack_repos
+          elif [[ " ${EXCLUDE_PACKS} " =~ " ${repo_name#${PACKS_PREFIX}-} " ]]; then
+            rm -rf ${repo_name}
+            echo "DELETED clone of ${PACKS_ORG}/${repo_name}: pack excluded via index.git/v1/exclude_packs.txt"
+            echo "${PACKS_ORG}/${repo_name}" >> ${GITHUB_WORKSPACE}/bad_pack_repos
+          fi
+        done
+        if [[ -f ${GITHUB_WORKSPACE}/bad_pack_repos ]]; then
+          echo "These repos were DELETED. See above for why."
+          cat ${GITHUB_WORKSPACE}/bad_pack_repos
+        fi
+
+    - name: Display Index Changes (git)
+      shell: bash
+      working-directory: index
+      run: |
+        git status
+        git diff
+
+    # validate.py and pack_content.py make no CI assumptions
+    # TODO: once we drop CircleCI move validate.py out of the .circle directory.
+    # TODO: maybe use imagemagick instead of gmic+optipng
+    - name: Rebuild index/v1/packs and index/v1/icons
+      shell: bash
+      env:
+        PACKS_ORG: ${{ inputs.packs_org }}
+        PACKS_PREFIX: ${{ inputs.pack_repo_prefix }}
+      working-directory: packs
+      run: |
+        for pack_dir in *; do
+          pack=${pack_dir#"$PACKS_PREFIX"-}
+          echo "::group::pack - ${pack}"
+          pushd ${pack_dir} >/dev/null
+          if ! PACK_NAME=$(${VIRTUALENV_DIR}/bin/python "${CI_DIR}/.circle/validate.py" "${pack_dir}" pack.yaml); then
+            echo "${PACKS_ORG}/${repo_name}" >> ${GITHUB_WORKSPACE}/bad_pack_repos
+            echo
+            echo "::endgroup::" # ensure SKIPPING notice is visible outside of the folded group
+            echo SKIPPING rebuild for ${pack_dir} because pack.yaml is not valid
+            continue
+          fi
+          # Rebuild pack index directory
+          ${VIRTUALENV_DIR}/bin/python "${CI_DIR}/utils/pack_content.py" --input . --output "${INDEX_DIR}/v1/packs/${PACK_NAME}"
+          # Check if an icon has been added or changed
+          ICON_TARGET="${INDEX_DIR}/v1/icons/${PACK_NAME}.png"
+          if [[ -f icon.png ]] && { [[ ! -f ${ICON_TARGET} ]] || ! cmp -s icon.png ${ICON_TARGET}; }; then
+            echo "Copying and optimizing the pack icon..."
+            mkdir -p ${INDEX_DIR}/v1/icons/
+            cp icon.png ${ICON_TARGET}
+            gmic ${ICON_TARGET} -resize 64,64 -output ${ICON_TARGET}
+            optipng -o5 ${ICON_TARGET}
+            echo "Icon copied and optimized."
+          fi
+          popd >/dev/null
+          echo
+          echo "::endgroup::"
+        done
+        if [[ -f ${GITHUB_WORKSPACE}/bad_pack_repos ]]; then
+          echo "These repos were SKIPPED or DELETED. See above or in checkout step logs for why."
+          cat ${GITHUB_WORKSPACE}/bad_pack_repos
+        fi
+
+    - name: Display Index Changes (git)
+      shell: bash
+      working-directory: index
+      run: |
+        git status
+        git diff
+
+    # TODO: once we drop CircleCI, update index.py to remove CircleCI-specific bits
+    #       and move out of the .circle directory.
+    - name: Rebuild index/v1/index.json
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        PACKS_ORG: ${{ inputs.packs_org }}
+        PACKS_PREFIX: ${{ inputs.pack_repo_prefix }}
+        FORCE_REBUILD_INDEX: ${{ inputs.force-rebuild-index }}
+      run: |
+        if [[ -n "$(git -C ${INDEX_DIR} status -s)" ]] || [[ ${FORCE_REBUILD_INDEX} == "true" ]]; then
+          if [[ ${FORCE_REBUILD_INDEX} == "true" ]]; then
+            echo "Forcing index rebuild..."
+          fi
+          ${VIRTUALENV_DIR}/bin/python "${CI_DIR}/.circle/index.py" --glob "${INDEX_DIR}/v1/packs/*/pack.yaml" --output "${INDEX_DIR}/v1/"
+        else
+          echo "No changes in metadata, skipping the index rebuild."
+        fi
+
+    - name: Display Index Changes (git)
+      shell: bash
+      working-directory: index
+      run: |
+        git status
+        git diff
+
+    - name: Git Auto Commit and Push Index
+      id: git-commit
+      uses: stefanzweifel/git-auto-commit-action@v4.12.0
+      with:
+        repository: index
+        # TODO: list changed packs in commit message
+        commit_message: Update Index (GHA)
+
+    - name: Display Index Changes (git)
+      shell: bash
+      working-directory: index
+      run: |
+        git status
+        git diff
diff --git a/.github/workflows/pack-build_and_test.yaml b/.github/workflows/pack-build_and_test.yaml
new file mode 100644
index 00000000..9ae7ae54
--- /dev/null
+++ b/.github/workflows/pack-build_and_test.yaml
@@ -0,0 +1,65 @@
+name: CI - Build and Test
+
+on:
+  workflow_call:
+    inputs:
+      apt-cache-version:
+        required: false
+        type: string
+        default: "v0"
+      py-cache-version:
+        required: false
+        type: string
+        default: "v0"
+      enable-common-libs:
+        description: |
+          When true, use an st2.conf that sets packs.enable_common_libs=true
+          see: https://docs.stackstorm.com/reference/sharing_code_sensors_actions.html
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  build_and_test:
+    runs-on: ubuntu-latest
+    # When parent workflow is named "Build and Test" this shows up as:
+    #   "Build and Test / Python 3.6"
+    name: 'Python ${{ matrix.python-version-short }}'
+    strategy:
+      matrix:
+        include:
+          - python-version-short: 3.6
+            python-version: 3.6.13
+    steps:
+      - name: Checkout Pack Repo and CI Repos
+        uses: StackStorm-Exchange/ci/.github/actions/checkout@master
+        
+      - name: Install APT Dependencies
+        uses: StackStorm-Exchange/ci/.github/actions/apt-dependencies@master
+        with:
+          cache-version: ${{ inputs.apt-cache-version }}
+
+      - name: Install Python Dependencies
+        uses: StackStorm-Exchange/ci/.github/actions/py-dependencies@master
+        with:
+          cache-version: ${{ inputs.py-cache-version }}
+          python-version: ${{ matrix.python-version }}
+
+      - name: Run pack tests
+        uses: StackStorm-Exchange/ci/.github/actions/test@master
+        with:
+          enable-common-libs: ${{ inputs.enable-common-libs }}
+
+    services:
+      mongo:
+        image: mongo:3.4
+        ports:
+          - 27017:27017
+      rabbitmq:
+        image: rabbitmq:3
+        ports:
+          - 5672:5672
+      #redis:
+      #  image: redis
+      #  ports:
+      #    - 6379:6379
diff --git a/.github/workflows/pack-repo_meta.yaml b/.github/workflows/pack-repo_meta.yaml
new file mode 100644
index 00000000..9a7871d3
--- /dev/null
+++ b/.github/workflows/pack-repo_meta.yaml
@@ -0,0 +1,49 @@
+name: Repo Metadata
+# TODO: this workflow is not function yet because GITHUB_TOKEN
+#       is not allowed to edit repo metadata (so far).
+
+on:
+  workflow_call:
+    outputs:
+      pack_description:
+        description: The current pack description according to pack.yaml
+        value: ${{ jobs.repo_meta.outputs.pack_description }}
+      repo_homepage:
+        description: The resulting repo homepage
+        value: ${{ jobs.repo_meta.outputs.repo_homepage }}
+      original_description:
+        description: The original description before running this workflow
+        value: ${{ jobs.repo_meta.outputs.original_description }}
+      original_homepage:
+        description: The original homepage before running this workflow
+        value: ${{ jobs.repo_meta.outputs.original_homepage }}
+      updated:
+        description: true if metadata was updated on the pack repo
+        value: ${{ jobs.repo_meta.outputs.updated }}
+
+jobs:
+  repo_meta:
+    runs-on: ubuntu-latest
+    name: 'Repo Metadata'
+
+    outputs:
+      pack_description: ${{ steps.repo-meta.outputs.pack_description }}
+      original_description: ${{ steps.repo-meta.outputs.original_description }}
+      repo_homepage: ${{ steps.repo-meta.outputs.repo_homepage }}
+      original_homepage: ${{ steps.repo-meta.outputs.original_homepage }}
+      updated_metadata: ${{ steps.repo-meta.outputs.updated }}
+
+    steps:
+      - name: Checkout Pack Repo
+        uses: actions/checkout@v2
+        # only the latest commit is needed
+
+      - name: Setup Python
+        uses: actions/setup-python@v2
+        with:
+          # use whatever github has in its local cache to speed this up
+          python-version: 3.8
+
+      - name: Update repo metadata
+        id: repo-meta
+        uses: StackStorm-Exchange/ci/.github/actions/repo-meta@master
diff --git a/.github/workflows/pack-tag_release.yaml b/.github/workflows/pack-tag_release.yaml
new file mode 100644
index 00000000..e555d4b5
--- /dev/null
+++ b/.github/workflows/pack-tag_release.yaml
@@ -0,0 +1,41 @@
+name: Tag Release
+
+on:
+  workflow_call:
+    outputs:
+      pack_version:
+        description: The current pack version according to pack.yaml
+        value: ${{ jobs.tag_release.outputs.pack_version }}
+      previous_tag:
+        description: The latest tag before running this workflow
+        value: ${{ jobs.tag_release.outputs.previous_tag }}
+      created_tag:
+        description: true if a new tag was pushed to the pack repo
+        value: ${{ jobs.tag_release.outputs.created_tag }}
+
+jobs:
+  tag_release:
+    runs-on: ubuntu-latest
+    name: 'Tag Release'
+
+    outputs:
+      pack_version: ${{ steps.tag-pack.outputs.pack_version }}
+      previous_tag: ${{ steps.tag-pack.outputs.previous_tag }}
+      created_tag: ${{ steps.tag-pack.outputs.created_tag }}
+
+    steps:
+      - name: Checkout Pack Repo
+        uses: actions/checkout@v2
+        with:
+          # A full clone is required to get the tags.
+          fetch-depth: 0
+
+      - name: Setup Python
+        uses: actions/setup-python@v2
+        with:
+          # use whatever github has in its local cache to speed this up
+          python-version: 3.8
+
+      - name: Check for and tag new version
+        id: tag-pack
+        uses: StackStorm-Exchange/ci/.github/actions/tag@master