diff --git a/.drone.yml b/.drone.yml
deleted file mode 100644
index 8c74ce58..00000000
--- a/.drone.yml
+++ /dev/null
@@ -1,203 +0,0 @@
----
-kind: pipeline
-name: default
-
-steps:
-- name: download-dependencies
-  image: golang:1.19
-  commands:
-    # wait for services to be ready.
-    # - cd scripts/liveness_probe
-    # - go run .
-    # - cd ../..
-    - go mod download
-    - go mod vendor # this is for when the Dockerfile gets built
-  environment:
-    GO111MODULE: on
-    # temporarily disabled until we move to Actions
-    # GOPROXY: http://athens-proxy:3000
-  volumes:
-  - name: cache
-    path: /go
-
-- name: build
-  image: golang:1.19
-  commands:
-
-  # build
-  - go build cmd/proxy/*.go
-
-  # test
-  - ./scripts/check_gofmt.sh
-  - go vet ./...
-  - go test -v ./...
-
-  # end to end test
-  - ./main & # run the just-built athens server
-  - sleep 3 # wait for it to spin up
-  - curl localhost:3000
-  - mkdir -p ~/happy
-  - mkdir -p ~/emptygopath # ensure the gopath has no modules cached.
-  - cd ~/happy
-  - git clone https://github.com/athens-artifacts/happy-path.git
-  - cd happy-path
-  - GOPATH=~/emptygopath GOPROXY=http://localhost:3000 go build
-  environment:
-    GO111MODULE: on
-    ATHENS_MONGO_STORAGE_URL: mongodb://mongo:27017
-    ATHENS_MINIO_ENDPOINT: minio:9000
-    REDIS_TEST_ENDPOINT: redis:6379
-    REDIS_SENTINEL_TEST_ENDPOINT: redis-sentinel:26379
-    REDIS_SENTINEL_TEST_MASTER_NAME: redis-1
-    REDIS_SENTINEL_TEST_PASSWORD: sekret
-    PROTECTED_REDIS_TEST_ENDPOINT: protectedredis:6380
-    ATHENS_PROTECTED_REDIS_PASSWORD: AthensPass1
-    GCS_SERVICE_ACCOUNT:
-      from_secret: GCS_SERVICE_ACCOUNT
-    GCS_PROJECT_ID:
-      from_secret: GOOGLE_CLOUD_PROJECT
-    ATHENS_AZURE_ACCOUNT_NAME:
-      from_secret: ATHENS_AZURE_ACCOUNT_NAME
-    ATHENS_AZURE_ACCOUNT_KEY:
-      from_secret: ATHENS_AZURE_ACCOUNT_KEY
-  when:
-    branch:
-      - main
-    event:
-      - push
-      - pull_request
-  volumes:
-  - name: cache
-    path: /go
-  depends_on:
-    - redis
-    - redis-sentinel
-
-- name: docker-latest
-  image: plugins/docker
-  settings:
-    username:
-      from_secret: DOCKER_USER
-    password:
-      from_secret: DOCKER_PASSWORD
-    repo: gomods/athens
-    tags:
-      - canary
-    dockerfile: cmd/proxy/Dockerfile
-    build_args:
-      - VERSION=${DRONE_COMMIT}
-  when:
-    branch:
-      - main
-    event:
-      - push
-
-- name: docker-latest-commit-sha
-  image: plugins/docker
-  settings:
-    username:
-      from_secret: DOCKER_USER
-    password:
-      from_secret: DOCKER_PASSWORD
-    repo: gomods/athens-dev
-    tags:
-      - ${DRONE_COMMIT:0:7}
-    dockerfile: cmd/proxy/Dockerfile
-    build_args:
-      - VERSION=${DRONE_COMMIT}
-  when:
-    branch:
-      - main
-    event:
-      - push
-
-- name: docker-release
-  image: plugins/docker
-  settings:
-    username:
-      from_secret: DOCKER_USER
-    password:
-      from_secret: DOCKER_PASSWORD
-    repo: gomods/athens
-    tags:
-      - ${DRONE_TAG}
-      - latest
-    dockerfile: cmd/proxy/Dockerfile
-    build_args:
-      - VERSION=${DRONE_TAG}
-
-  when:
-    event:
-      - tag
-
-- name: publish-helm
-  image: gomods/drone-helm
-  settings:
-    charts_repo: https://athens.blob.core.windows.net
-  environment:
-    AZURE_STORAGE_CONNECTION_STRING:
-      from_secret: AZURE_STORAGE_CONNECTION_STRING
-  when:
-    branch:
-      - main
-    event:
-     - push
-
-# Here we can add any backend storage that can be tested.
-services:
-- name: mongo
-  image: mongo
-  ports:
-  - 27017
-- name: minio
-  image: minio/minio:latest
-  command:
-    - server
-    - /data
-  ports:
-    - 9000
-  environment:
-    MINIO_ACCESS_KEY: minio
-    MINIO_SECRET_KEY: minio123
-- name: redis
-  image: redis
-  ports:
-    - 6379
-- name: redis-sentinel
-  image: bitnami/redis-sentinel
-  environment:
-    REDIS_MASTER_HOST: redis
-    REDIS_MASTER_SET: redis-1
-    REDIS_SENTINEL_PASSWORD: sekret
-    REDIS_SENTINEL_QUORUM: "1"
-  ports:
-    - 26379
-  depends_on:
-    - redis
-- name: protectedredis
-  image: redis
-  ports:
-    - 6380
-  commands:
-    - "redis-server ./test/redis.conf"
-- name: athens-proxy
-  image: gomods/athens:canary
-  pull: always
-  ports:
-    - 3000
-  environment:
-    ATHENS_GOGET_WORKERS: 5
-    ATHENS_PROTOCOL_WORKERS: 10
-    ATHENS_SINGLE_FLIGHT_TYPE: gcp
-    ATHENS_STORAGE_TYPE: gcp
-    ATHENS_STORAGE_GCP_BUCKET: "athens_ci_build"
-    ATHENS_STORAGE_GCP_JSON_KEY:
-      from_secret: GCS_SERVICE_ACCOUNT
-volumes:
-  - name: cache
-    temp: {}
----
-kind: signature
-hmac: 8ee2a04fedfd1a0c1ab3da19a3441485bf447de3e04fe057f626c83454a042b6
-
-...
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..3593c3b0
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,62 @@
+name: continuous-integration
+on:
+  - push
+  - pull_request
+jobs:
+  build:
+    env:
+      ATHENS_MONGO_STORAGE_URL: mongodb://localhost:27017
+      ATHENS_MINIO_ENDPOINT: localhost:9000
+      REDIS_TEST_ENDPOINT: localhost:6379
+      REDIS_SENTINEL_TEST_ENDPOINT: localhost:26379
+      REDIS_SENTINEL_TEST_MASTER_NAME: redis-1
+      REDIS_SENTINEL_TEST_PASSWORD: sekret
+      PROTECTED_REDIS_TEST_ENDPOINT: localhost:6380
+      ATHENS_PROTECTED_REDIS_PASSWORD: AthensPass1
+    runs-on: ubuntu-latest
+    services:
+      mongo:
+        image: mongo
+        ports:
+          - 27017:27017
+      minio:
+        image: minio/minio:edge-cicd
+        ports:
+          - 9000:9000
+        env:
+          MINIO_ACCESS_KEY: minio
+          MINIO_SECRET_KEY: minio123
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+      redis-sentinel:
+        image: bitnami/redis-sentinel
+        env:
+          REDIS_MASTER_HOST: redis
+          REDIS_MASTER_SET: redis-1
+          REDIS_SENTINEL_PASSWORD: sekret
+          REDIS_SENTINEL_QUORUM: "1"
+        ports:
+          - 26379:26379
+      protectedredis:
+        image: bitnami/redis
+        ports:
+          - 6380:6380
+        env:
+          REDIS_PORT_NUMBER: 6380
+          REDIS_PASSWORD: AthensPass1
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+      - name: Run linter
+        run: make verify
+      - name: Unit tests
+        run: go test -v -race ./...
+      - name: End to end tests
+        if: success() || failure()
+        run: make test-e2e
diff --git a/.github/workflows/release.canary.yml b/.github/workflows/release.canary.yml
new file mode 100644
index 00000000..095b534d
--- /dev/null
+++ b/.github/workflows/release.canary.yml
@@ -0,0 +1,29 @@
+name: Release canary and commit tags
+on:
+  push:
+    branches:
+      - main
+jobs:
+  docker-push-main:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Build and push canary tag
+        uses: docker/build-push-action@v4
+        with:
+          file: cmd/proxy/Dockerfile
+          build-args: VERSION=${{github.sha}}
+          tags: gomods/athens:canary
+      - name: Build and push commit tag
+        uses: docker/build-push-action@v4
+        with:
+          file: cmd/proxy/Dockerfile
+          build-args: VERSION=${{github.sha}}
+          tags: gomods/athens-dev:${GITHUB_SHA::7}
diff --git a/.github/workflows/release.latest.yml b/.github/workflows/release.latest.yml
new file mode 100644
index 00000000..02885201
--- /dev/null
+++ b/.github/workflows/release.latest.yml
@@ -0,0 +1,23 @@
+name: release-latest
+on:
+  push:
+    tags:
+      - '**'
+jobs:
+  docker-push-main:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Build and push latest tag
+        uses: docker/build-push-action@v4
+        with:
+          file: cmd/proxy/Dockerfile
+          build-args: VERSION=${{github.sha}}
+          tags: gomods/athens:latest
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 83ae09bd..120ecc61 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -12,7 +12,6 @@ builds:
     - darwin
   goarch:
     - amd64
-    - x86_64
   main: cmd/proxy/main.go
   binary: athens
   ldflags:
diff --git a/e2etests/filesystem.go b/e2etests/filesystem.go
index 7ff059c9..06945727 100644
--- a/e2etests/filesystem.go
+++ b/e2etests/filesystem.go
@@ -1,3 +1,4 @@
+//go:build e2etests
 // +build e2etests
 
 package e2etests
diff --git a/e2etests/run_athens.go b/e2etests/run_athens.go
index 5546a0fe..f5ed016b 100644
--- a/e2etests/run_athens.go
+++ b/e2etests/run_athens.go
@@ -1,3 +1,4 @@
+//go:build e2etests
 // +build e2etests
 
 package e2etests
diff --git a/pkg/build/build.go b/pkg/build/build.go
index 81395e36..bfb74b25 100644
--- a/pkg/build/build.go
+++ b/pkg/build/build.go
@@ -22,8 +22,9 @@ var version, buildDate string
 //
 // i.e.
 // Build Details:
-//         Version:        v0.1.0-155-g1a20f8b
-//         Date:           2018-11-05-14:33:14-UTC
+//
+//	Version:        v0.1.0-155-g1a20f8b
+//	Date:           2018-11-05-14:33:14-UTC
 func String() string {
 	return fmt.Sprintf("Build Details:\n\tVersion:\t%s\n\tDate:\t\t%s", version, buildDate)
 }
diff --git a/pkg/errors/errors_test.go b/pkg/errors/errors_test.go
index 7556f67f..b3c43b44 100644
--- a/pkg/errors/errors_test.go
+++ b/pkg/errors/errors_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/suite"
 )
 
-//OpTests composes a testsuite to run all the Ops related tests in one group
+// OpTests composes a testsuite to run all the Ops related tests in one group
 type OpTests struct {
 	suite.Suite
 }
diff --git a/pkg/module/filter.go b/pkg/module/filter.go
index 5c02e817..80b04eaa 100644
--- a/pkg/module/filter.go
+++ b/pkg/module/filter.go
@@ -24,12 +24,15 @@ type Filter struct {
 // WARNING: this is not concurrently safe
 // Configuration consists of two operations: + for include and - for exclude
 // e.g.
-//    - github.com/a
-//    + github.com/a/b
+//   - github.com/a
+//   - github.com/a/b
+//
 // will communicate all modules except github.com/a and its children, but github.com/a/b will be communicated
 // example 2:
-//   -
-//   + github.com/a
+//
+//	-
+//	+ github.com/a
+//
 // will exclude all items from communication except github.com/a
 func NewFilter(filterFilePath string) (*Filter, error) {
 	// Do not return an error if the file path is empty
diff --git a/pkg/observ/observ.go b/pkg/observ/observ.go
index f144da0c..15181c33 100755
--- a/pkg/observ/observ.go
+++ b/pkg/observ/observ.go
@@ -4,10 +4,10 @@ import (
 	"context"
 	"fmt"
 
+	"contrib.go.opencensus.io/exporter/jaeger"
 	"contrib.go.opencensus.io/exporter/stackdriver"
 	datadog "github.com/DataDog/opencensus-go-exporter-datadog"
 	"github.com/gomods/athens/pkg/errors"
-	"contrib.go.opencensus.io/exporter/jaeger"
 	"go.opencensus.io/trace"
 )
 
diff --git a/pkg/storage/gcp/doc.go b/pkg/storage/gcp/doc.go
index 0207e692..3aba382b 100644
--- a/pkg/storage/gcp/doc.go
+++ b/pkg/storage/gcp/doc.go
@@ -2,7 +2,7 @@
 Package gcp provides a storage driver to upload module files to a google
 cloud platform storage bucket.
 
-Configuration
+# Configuration
 
 Environment variables:
 
@@ -15,6 +15,5 @@ Example:
 		export ATHENS_STORAGE_GCP_BUCKET="fancy-pony-33928.appspot.com"
 	Fish:
 		set -x ATHENS_STORAGE_GCP_BUCKET fancy-pony-339288.appspot.com
-
 */
 package gcp
diff --git a/pkg/storage/s3/doc.go b/pkg/storage/s3/doc.go
index 03e66db8..455e8038 100644
--- a/pkg/storage/s3/doc.go
+++ b/pkg/storage/s3/doc.go
@@ -2,9 +2,10 @@
 Package s3 provides a storage driver to upload module files to
 amazon s3 storage bucket.
 
-Configuration
+# Configuration
 
 Environment variables:
+
 	AWS_REGION				// region for this storage, e.g 'us-west-2'
 	AWS_ACCESS_KEY_ID
 	AWS_SECRET_ACCESS_KEY
@@ -20,6 +21,5 @@ Example:
 		export AWS_REGION="us-west-2"
 	Fish:
 		set -x AWS_REGION us-west-2
-
 */
 package s3
diff --git a/pkg/storage/s3/s3_test.go b/pkg/storage/s3/s3_test.go
index f24b40e8..6cc54e6a 100644
--- a/pkg/storage/s3/s3_test.go
+++ b/pkg/storage/s3/s3_test.go
@@ -80,10 +80,10 @@ func getStorage(t testing.TB) *Storage {
 	}
 	backend, err := New(
 		&config.S3Config{
-			Key:    "minio",
-			Secret: "minio123",
-			Bucket: "gomodsaws",
-			Region: "us-west-1",
+			Key:            "minio",
+			Secret:         "minio123",
+			Bucket:         "gomodsaws",
+			Region:         "us-west-1",
 			ForcePathStyle: true,
 		},
 		config.GetTimeoutDuration(300),
diff --git a/scripts/check_gofmt.sh b/scripts/check_gofmt.sh
index 67d6dd34..f79aa9fe 100755
--- a/scripts/check_gofmt.sh
+++ b/scripts/check_gofmt.sh
@@ -4,5 +4,7 @@
 # Fail if a .go file hasn't been formatted with gofmt
 set -euo pipefail
 
-GO_FILES=$(find . -iname '*.go' -type f)   # All the .go files
-test -z $(gofmt -s -d "$GO_FILES" | tee /dev/stderr)
+GO_FILES=$(find . -iname '*.go' -type f -not -path "./vendor/*")   # All the .go files
+for f in $GO_FILES; do
+  test -z "$(gofmt -s -w "$f" | tee /dev/stderr)"
+done