TECH-7711: Migrate CI from CircleCI to GitHub Actions

[DevBaca]

Summary

• Removes .circleci/config.yml
• Adds .github/workflows/ci.yaml — matrix build/test on Elixir 1.19.2/OTP 28.1.1 and 1.18.4/OTP 27.3.4.4 (mirroring the CircleCI matrix), quality checks (format, credo, dialyzer) and docs/hex.build on the latest version only, plus a spelling/markdownlint job (cspell + markdownlint-cli2)
• Adds .github/workflows/release.yaml — on v* tag push: verifies mix.exs/CHANGELOG/tag version alignment, creates the GitHub Release from CHANGELOG notes, publishes to Hex

Review fix

• test job now sets MIX_ENV: test at the job level. Without it, mix compile --warnings-as-errors ran under Mix's default :dev env instead of :test, so warnings in test-support code (elixirc_paths(:test) includes test/support/) weren't caught the way CircleCI's identical compile step caught them.

Test Plan

• GHA ci.yaml passes (both matrix legs + spelling/markdownlint)
• lrzsz installs cleanly and LRZWriter's System.find_executable("lrz")/"rz" resolves on ubuntu-latest
• HEX_API_WRITE_KEY secret added
• Confirm release.yaml creates the GitHub Release and publishes to Hex on the next tag

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	erlef/​setup-beam@​54075bcc5e249e4758d363f27d099f55d843f124
	actions/​cache@​55cc8345863c7cc4c66a329aec7e433d2d1c52a9

View full report

[socket-security]

Warning

Please read and follow SmartRent's Secure Development policy to resolve these alerts.

Reach out to security@smartrent.com if you have any questions.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Network access: github actions/cache Location: Package overview From: .github/workflows/ci.yaml → github/actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: github erlef/setup-beam Location: Package overview From: .github/workflows/ci.yaml → github/erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): github erlef/setup-beam is 62.0% likely to have a medium risk anomaly Notes: No clear evidence of intentional malware/backdoor behavior is visible in this fragment. However, it performs high-risk operations: executing PowerShell with ExecutionPolicy 'Unrestricted' using string-built commands for archive extraction, and downloading/extracting third-party binaries without visible integrity/signature verification. This combination warrants security review and hardening (integrity checks; safer command execution; archive extraction safeguards against traversal/symlinks). Confidence: 0.62 Severity: 0.66 From: .github/workflows/ci.yaml → github/erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report