diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000000..bdc8e826f01
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,200 @@
+name: CI tests
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ !contains(github.ref, 'heads/master') }}
+
+jobs:
+  build_jdk:
+    runs-on: ubuntu-latest
+    container:
+      image: wmdietl/cf-ubuntu-jdk17-plus:latest
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+    
+      - name: Show environment
+        run: |
+          whoami
+          git config --get remote.origin.url
+          pwd
+          ls -al
+          env | sort
+    
+      - name: Download jtreg
+        run: |
+          wget https://builds.shipilev.net/jtreg/jtreg-6.2%2B1.zip -O /tmp/$USER/jtreg.zip
+          unzip /tmp/$USER/jtreg.zip -d /tmp/$USER/
+          chmod +x /tmp/$USER/jtreg/bin/jtdiff /tmp/$USER/jtreg/bin/jtreg
+    
+      - name: Configure
+        run: |
+          pwd && ls && bash ./configure --with-jtreg=/tmp/$USER/jtreg --disable-warnings-as-errors
+    
+      - name: Make JDK
+        run: make jdk
+        timeout-minutes: 90
+
+  build_jdk17u:
+    runs-on: ubuntu-latest
+    container:
+      image: wmdietl/cf-ubuntu-jdk17-plus:latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Show environment
+        run: |
+          whoami
+          git config --get remote.origin.url
+          pwd
+          ls -al
+          env | sort
+
+      - name: Download jtreg
+        run: |
+          wget https://builds.shipilev.net/jtreg/jtreg-6.2%2B1.zip -O /tmp/$USER/jtreg.zip
+          unzip /tmp/$USER/jtreg.zip -d /tmp/$USER/
+          chmod +x /tmp/$USER/jtreg/bin/jtdiff /tmp/$USER/jtreg/bin/jtreg
+
+      - name: Clone plume-scripts
+        run: |
+          set -ex
+          if [ -d /tmp/$USER/plume-scripts ]; then
+            git -C /tmp/$USER/plume-scripts pull -q > /dev/null 2>&1
+          else
+            mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth 1 -q https://github.com/eisop-plume-lib/plume-scripts.git
+          fi
+
+      - name: Clone git-scripts
+        run: |
+          set -ex
+          if [ -d /tmp/$USER/git-scripts ]; then
+            git -C /tmp/$USER/git-scripts pull -q > /dev/null 2>&1
+          else
+            mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth 1 -q https://github.com/eisop-plume-lib/git-scripts.git
+          fi
+
+      - name: Clone related jdk17u
+        run: |
+          set -ex
+          /tmp/$USER/git-scripts/git-clone-related typetools jdk17u ../jdk17u -q --depth 1
+
+      - name: Git merge
+        run: |
+          set -ex
+          git config --global user.email "you@example.com"
+          git config --global user.name "Your Name"
+          git config --global pull.ff true
+          git config --global pull.rebase false
+          eval `/tmp/$USER/plume-scripts/ci-info eisop`
+          cd ../jdk17u && git pull --no-edit https://github.com/${{ secrets.CI_ORGANIZATION }}/jdk ${{ secrets.CI_BRANCH }} || (git --version && git show && echo "Merge failed; see 'Pull request merge conflicts' at https://github.com/eisop/jdk/blob/master/README" && false)
+
+      - name: Configure
+        run: cd ../jdk17u && export JT_HOME=/tmp/$USER/jtreg && bash ./configure --with-jtreg=/tmp/$USER/jtreg --disable-warnings-as-errors
+
+      - name: Make JDK
+        run: cd ../jdk17u && make jdk
+
+  sanity:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java_version }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        script: ['cftests-junit', 'cftests-nonjunit']
+        java_version: [17]
+    env:
+      JAVA_VERSION: ${{ matrix.java_version }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up JDK ${{ matrix.java_version }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ matrix.java_version }}
+          distribution: 'temurin'
+    
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4.1.0
+    
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.9.0
+        if: matrix.script == 'cftests-nonjunit'
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}
+          repository-cache: true
+    
+      - name: Run test script checker/bin-devel/test-${{ matrix.script }}.sh
+        run: ./checker/bin-devel/test-${{ matrix.script }}.sh
+
+  remainder:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java_version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        script: ['cftests-inference', 'typecheck-part1', 'typecheck-part2', 'plume-lib', 'daikon-part1', 'daikon-part2']
+        java_version: [21]
+    env:
+      JAVA_VERSION: ${{ matrix.java_version }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up JDK ${{ matrix.java_version }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ matrix.java_version }}
+          distribution: 'temurin'
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4.1.0
+    
+      - name: Run test script checker/bin-devel/test-${{ matrix.script }}.sh
+        run: ./checker/bin-devel/test-${{ matrix.script }}.sh
+        if: (matrix.java_version != 8 || (matrix.script != 'plume-lib')) && 
+            (matrix.java_version <= 21 || (matrix.script != 'daikon-part1' && matrix.script != 'daikon-part2'))
+
+  otherjdks:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java.version }}
+    runs-on: ubuntu-latest
+    needs: sanity
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: true
+      matrix:
+        script: ['cftests-junit', 'cftests-nonjunit', 'cftests-inference', 'typecheck-part1', 'typecheck-part2']
+        java: [{version: '8', experimental: false}, {version: '11', experimental: false}, {version: '21', experimental: false}, {version: '22', experimental: true}, {version: '23-ea', experimental: true}, {version: '24-ea', experimental: true}]
+    env:
+      JAVA_VERSION: ${{ matrix.java.version }}
+    continue-on-error: ${{ matrix.java.experimental }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up JDK ${{ matrix.java.version }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ matrix.java.version }}
+          distribution: 'temurin'
+    
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4.1.0
+    
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.9.0
+        if: matrix.script == 'cftests-nonjunit'
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}
+          repository-cache: true
+    
+      - name: Run test script checker/bin-devel/test-${{ matrix.script }}.sh
+        run: ./checker/bin-devel/test-${{ matrix.script }}.sh
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
deleted file mode 100644
index 9784c3888e0..00000000000
--- a/azure-pipelines.yml
+++ /dev/null
@@ -1,201 +0,0 @@
-# variables:
-#   system.debug: true
-
-jobs:
-
-- job: build_jdk
-  pool:
-    vmImage: 'ubuntu-latest'
-  container: wmdietl/cf-ubuntu-jdk17-plus:latest
-  steps:
-  - bash: |
-      whoami
-      git config --get remote.origin.url
-      pwd
-      ls -al
-      env | sort
-    displayName: show environment
-  - bash: pwd && ls && bash ./configure --with-jtreg=/usr/share/jtreg --disable-warnings-as-errors
-    displayName: configure
-  - bash: make jdk
-    timeoutInMinutes: 90
-    displayName: make jdk
-  ## This works only after `make images`
-  # - bash: build/*/images/jdk/bin/java -version
-  #   displayName: version
-  ## Don't run tests, which pass only with old version of tools (compilers, etc.).
-  # - bash: make -C /jdk run-test-tier1
-  #   displayName: make run-test-tier1
-
-- job: build_jdk17u
-  pool:
-    vmImage: 'ubuntu-latest'
-  container: wmdietl/cf-ubuntu-jdk17-plus:latest
-  timeoutInMinutes: 0
-  steps:
-  - bash: |
-      whoami
-      git config --get remote.origin.url
-      pwd
-      ls -al
-      env | sort
-    displayName: show environment
-  - bash: |
-      set -ex
-      if [ -d /tmp/$USER/git-scripts ]; \
-        then git -C /tmp/$USER/git-scripts pull -q > /dev/null 2>&1 ; \
-        else mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth=1 -q https://github.com/eisop-plume-lib/git-scripts.git ; \
-      fi
-    displayName: git-scripts
-  - bash: |
-      set -ex
-      if [ -d /tmp/$USER/plume-scripts ]; \
-        then git -C /tmp/$USER/plume-scripts pull -q > /dev/null 2>&1 ; \
-        else mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth=1 -q https://github.com/eisop-plume-lib/plume-scripts.git ; \
-      fi
-    displayName: plume-scripts
-  # This creates ../jdk17u .
-  # If the depth is too small, the merge will fail.  However, we cannot use "--filter=blob:none"
-  # because that leads to "fatal: remote error: filter 'combine' not supported".
-  - bash: |
-      set -ex
-      pwd
-      ls -al .. || true
-      ls -al ../jdk17u || true
-      df .
-      /tmp/$USER/git-scripts/git-clone-related typetools jdk17u ../jdk17u --depth 999
-      git config --global user.email "you@example.com"
-      git config --global user.name "Your Name"
-      git config --global core.longpaths true
-      git config --global core.protectNTFS false
-      cd ../jdk17u && git status
-      git diff --exit-code
-      echo $?
-    displayName: clone-related-jdk17u
-  - bash: |
-      set -ex
-      git config --global user.email "you@example.com"
-      git config --global user.name "Your Name"
-      git config --global pull.ff true
-      git config --global pull.rebase false
-      git config --global core.longpaths true
-      git config --global core.protectNTFS false
-      eval `/tmp/$USER/plume-scripts/ci-info eisop`
-      cd ../jdk17u && git status
-      echo "About to run: git pull --no-edit https://github.com/${CI_ORGANIZATION}/jdk ${CI_BRANCH}"
-      cd ../jdk17u && git pull --no-edit https://github.com/${CI_ORGANIZATION}/jdk ${CI_BRANCH} || (git --version && git show && git status && echo "Merge failed; see 'Pull request merge conflicts' at https://github.com/eisop/jdk/blob/master/README.md" && false)
-    displayName: git merge
-  - bash: cd ../jdk17u && export JT_HOME=/usr/share/jtreg && bash ./configure --with-jtreg=/usr/share/jtreg --disable-warnings-as-errors
-    displayName: configure
-  - bash: cd ../jdk17u && make jdk
-    displayName: make jdk
-  ## This works only after `make images`
-  # - bash: cd ../jdk17u && build/*/images/jdk/bin/java -version
-  #   displayName: version
-  # - bash: make -C /jdk17u run-test-tier1
-  #   timeoutInMinutes: 0
-  #   displayName: make run-test-tier1
-  # - bash: make -C /jdk17u :test/jdk:tier1
-  ## Temporarily comment out because of trouble finding junit and jasm
-  # - bash: cd ../jdk17u && make run-test TEST="jtreg:test/jdk:tier1"
-  #   timeoutInMinutes: 0
-  #   displayName: make run-test
-
-- job: test_cftests_all_jdk8
-  timeoutInMinutes: 105
-  pool:
-    vmImage: 'ubuntu-latest'
-  container: wmdietl/cf-ubuntu-jdk8:latest
-  steps:
-  - checkout: self
-    fetchDepth: 25
-  - bash: mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth 1 -q https://github.com/eisop-plume-lib/plume-scripts.git
-    displayName: clone plume-scripts
-  - bash: mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth 1 -q https://github.com/eisop-plume-lib/git-scripts.git
-    displayName: clone git-scripts
-  - bash: /tmp/$USER/git-scripts/git-clone-related eisop checker-framework
-    displayName: clone checker-framework
-  - bash: (cd ../checker-framework && checker/bin-devel/test-cftests-all.sh)
-    displayName: test-cftests-all.sh
-
-- job: test_cftests_all_jdk11
-  timeoutInMinutes: 120
-  pool:
-    vmImage: 'ubuntu-latest'
-  container: wmdietl/cf-ubuntu-jdk11:latest
-  steps:
-  - checkout: self
-    fetchDepth: 25
-  - bash: mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth=1 -q https://github.com/eisop-plume-lib/git-scripts.git
-    displayName: clone git-scripts
-  - bash: /tmp/$USER/git-scripts/git-clone-related eisop checker-framework
-    displayName: clone checker-framework
-  - bash: (cd ../checker-framework && checker/bin-devel/test-cftests-all.sh)
-    displayName: test-cftests-all.sh
-## Here is how to create artifacts that can be downloaded.
-#   - bash: (cd ../checker-framework/checker/build/jtregJdk11/ && tar -czvf all.tgz all)
-#     condition: succeededOrFailed()
-#     displayName: tar jtregJdk11/all
-#   - publish: $(System.DefaultWorkingDirectory)/../checker-framework/checker/build/jtregJdk11/all.tgz
-#     artifact: all.tgz
-#     condition: failed()
-#     displayName: publish all.tgz
-
-- job: test_cftests_all_jdk17
-  timeoutInMinutes: 120
-  pool:
-    vmImage: 'ubuntu-latest'
-  container: wmdietl/cf-ubuntu-jdk17:latest
-  steps:
-  - checkout: self
-    fetchDepth: 25
-  - bash: mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth=1 -q https://github.com/eisop-plume-lib/git-scripts.git
-    displayName: clone git-scripts
-  - bash: /tmp/$USER/git-scripts/git-clone-related eisop checker-framework
-    displayName: clone checker-framework
-  - bash: (cd ../checker-framework && checker/bin-devel/test-cftests-all.sh)
-    displayName: test-cftests-all.sh
-
-- job: test_cftests_all_jdk_latest
-  timeoutInMinutes: 120
-  pool:
-    vmImage: 'ubuntu-latest'
-  container: wmdietl/cf-ubuntu-jdk-latest:latest
-  steps:
-  - checkout: self
-    fetchDepth: 25
-  - bash: mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth=1 -q https://github.com/eisop-plume-lib/git-scripts.git
-    displayName: clone git-scripts
-  - bash: /tmp/$USER/git-scripts/git-clone-related eisop checker-framework
-    displayName: clone checker-framework
-  - bash: (cd ../checker-framework && checker/bin-devel/test-cftests-all.sh)
-    displayName: test-cftests-all.sh
-
-- job: test_daikon
-  pool:
-    vmImage: 'ubuntu-latest'
-  container: wmdietl/cf-ubuntu-jdk17:latest
-  timeoutInMinutes: 70
-  steps:
-  - checkout: self
-    fetchDepth: 25
-  - bash: mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth=1 -q https://github.com/eisop-plume-lib/git-scripts.git
-    displayName: clone git-scripts
-  - bash: /tmp/$USER/git-scripts/git-clone-related eisop checker-framework
-    displayName: clone checker-framework
-  - bash: (cd ../checker-framework && checker/bin-devel/test-daikon.sh)
-    displayName: test-daikon.sh
-
-- job: test_plume_lib
-  pool:
-    vmImage: 'ubuntu-latest'
-  container: wmdietl/cf-ubuntu-jdk17:latest
-  steps:
-  - checkout: self
-    fetchDepth: 25
-  - bash: mkdir -p /tmp/$USER && git -C /tmp/$USER clone --depth=1 -q https://github.com/eisop-plume-lib/git-scripts.git
-    displayName: clone git-scripts
-  - bash: /tmp/$USER/git-scripts/git-clone-related eisop checker-framework
-    displayName: clone checker-framework
-  - bash: (cd ../checker-framework && checker/bin-devel/test-plume-lib.sh)
-    displayName: test-plume-lib.sh