diff --git a/.circleci/config.yml b/.circleci/config.yml
index dd9adf4c00..b9f91766c9 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -140,121 +140,6 @@ jobs:
           path: lib-extra/build/test-results/test
       - store_test_results:
           path: plugin-gradle/build/test-results/test
-  changelog_print:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - run:
-          name: gradlew changelogPrint
-          command: ./gradlew changelogPrint
-  do_release_all:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :changelogPush
-          command: ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all
-      - run:
-          name: gradlew :plugin-gradle:changelogPush
-          command: ./gradlew :plugin-gradle:changelogPush -Prelease=true -Pgradle.publish.key=${gradle_key} -Pgradle.publish.secret=${gradle_secret} --stacktrace --warning-mode all
-      - run:
-          name: gradlew :plugin-maven:changelogPush
-          command: ./gradlew :plugin-maven:changelogPush -Prelease=true --stacktrace --warning-mode all
-  do_release_lib:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :changelogPush
-          command: ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all
-  do_release_plugin_gradle:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :plugin-gradle:changelogPush
-          command: ./gradlew :plugin-gradle:changelogPush -Prelease=true -Pgradle.publish.key=${gradle_key} -Pgradle.publish.secret=${gradle_secret} --stacktrace
-  do_release_plugin_maven:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :plugin-maven:changelogPush
-          command: ./gradlew :plugin-maven:changelogPush -Prelease=true --stacktrace
-  ext_changelog_print:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew -Pcom.diffplug.spotless.include.ext.nop2=true changelogPrint
-          command: ./gradlew -Pcom.diffplug.spotless.include.ext.nop2=true changelogPrint
-  ext_do_release_base:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :eclipse-base:changelogPush
-          command: ./gradlew -Pcom.diffplug.spotless.include.ext.nop2=true :eclipse-base:changelogPush -Prelease=true --stacktrace
-  ext_do_release_jdt:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :eclipse-jdt:changelogPush
-          command: ./gradlew -Pcom.diffplug.spotless.include.ext.nop2=true :eclipse-jdt:changelogPush -Prelease=true --stacktrace
-  ext_do_release_cdt:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :eclipse-cdt:changelogPush
-          command: ./gradlew -Pcom.diffplug.spotless.include.ext.cdt=true :eclipse-cdt:changelogPush -Prelease=true --stacktrace
-  ext_do_release_groovy:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :eclipse-groovy:changelogPush
-          command: ./gradlew -Pcom.diffplug.spotless.include.ext.groovy=true :eclipse-groovy:changelogPush -Prelease=true --stacktrace
-  ext_do_release_wtp:
-    << : *env_gradle
-    steps:
-      - checkout
-      - *restore_cache_wrapper
-      - *restore_cache_deps
-      - *set_git_origin_to_https
-      - run:
-          name: gradlew :eclipse-wtp:changelogPush
-          command: ./gradlew -Pcom.diffplug.spotless.include.ext.wtp=true :eclipse-wtp:changelogPush -Prelease=true --stacktrace
 
 workflows:
   version: 2
@@ -274,105 +159,3 @@ workflows:
       - test_npm_8:
           requires:
             - assemble_testClasses
-  deploy:
-    jobs:
-      - changelog_print:
-          filters:
-            branches:
-              only: main
-      - release_all:
-          type: approval
-          requires:
-            - changelog_print
-      - do_release_all:
-          requires:
-            - release_all
-          context:
-            - SonatypeDeploy
-      - release_plugin_gradle:
-          type: approval
-          requires:
-            - changelog_print
-      - do_release_plugin_gradle:
-          requires:
-            - release_plugin_gradle
-          context:
-            - SonatypeDeploy
-      - release_plugin_maven:
-          type: approval
-          requires:
-            - changelog_print
-      - do_release_plugin_maven:
-          requires:
-            - release_plugin_maven
-          context:
-            - SonatypeDeploy
-      - release_lib:
-          type: approval
-          requires:
-            - changelog_print
-      - do_release_lib:
-          requires:
-            - release_lib
-          context:
-            - SonatypeDeploy
-  ext_deploy:
-    jobs:
-      - ext_changelog_print:
-          filters:
-            branches:
-              only: main
-      - ext_release_base:
-          type: approval
-          requires:
-            - ext_changelog_print
-      - ext_do_release_base:
-          requires:
-            - ext_release_base
-          context:
-            - SonatypeDeploy
-      - ext_release_jdt:
-          type: approval
-          requires:
-            - ext_changelog_print
-      - ext_do_release_jdt:
-          requires:
-            - ext_release_jdt
-          context:
-            - SonatypeDeploy
-      - ext_release_cdt:
-          type: approval
-          requires:
-            - ext_changelog_print
-      - ext_do_release_cdt:
-          filters:
-            branches:
-              only: main
-          requires:
-            - ext_release_cdt
-          context:
-            - SonatypeDeploy
-      - ext_release_groovy:
-          type: approval
-          requires:
-            - ext_changelog_print
-      - ext_do_release_groovy:
-          filters:
-            branches:
-              only: main
-          requires:
-            - ext_release_groovy
-          context:
-            - SonatypeDeploy
-      - ext_release_wtp:
-          type: approval
-          requires:
-            - ext_changelog_print
-      - ext_do_release_wtp:
-          filters:
-            branches:
-              only: main
-          requires:
-            - ext_release_wtp
-          context:
-            - SonatypeDeploy
diff --git a/.github/workflows/changelog-print.yml b/.github/workflows/changelog-print.yml
new file mode 100644
index 0000000000..0641124750
--- /dev/null
+++ b/.github/workflows/changelog-print.yml
@@ -0,0 +1,20 @@
+name: changelogPrint
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    name: changelogPrint
+    steps:
+      - uses: actions/checkout@v3
+      - name: jdk 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: 11
+          distribution: 'temurin'
+      - name: gradle caching
+        uses: gradle/gradle-build-action@v2
+      - run: ./gradlew changelogPrint
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000000..6af73db448
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,63 @@
+# GH_TOKEN
+# NEXUS_USER
+# NEXUS_PASS
+# GPG_PASSPHRASE
+# GPG_KEY (base64)
+#   gpg --export-secret-keys --armor KEY_ID | openssl base64 | pbcopy
+# GRADLE_PORTAL_KEY
+# GRADLE_PORTAL_SECRET
+
+name: deploy
+on:
+  workflow_dispatch:
+    inputs:
+      to_publish:
+        description: 'What to publish'
+        required: true
+        default: 'all'
+        type: choice
+        options:
+          - plugin-gradle
+          - plugin-maven
+          - all
+          - lib
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    name: deploy
+    env:
+      gh_token: ${{ secrets.GH_TOKEN }}
+      ORG_GRADLE_PROJECT_nexus_user: ${{ secrets.NEXUS_USER }}
+      ORG_GRADLE_PROJECT_nexus_pass: ${{ secrets.NEXUS_PASS }}
+      ORG_GRADLE_PROJECT_gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
+      ORG_GRADLE_PROJECT_gpg_key64: ${{ secrets.GPG_KEY }}
+
+        gradle_key
+    steps:
+      - uses: actions/checkout@v3
+      - name: jdk 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: 11
+          distribution: 'temurin'
+      - name: gradle caching
+        uses: gradle/gradle-build-action@v2
+      - name: publish all
+        if: "${{ github.event.inputs.to_publish == 'all' }}"
+        run: |
+          ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all
+          ./gradlew :plugin-gradle:changelogPush -Prelease=true -Pgradle.publish.key=${{ secrets.GRADLE_PORTAL_KEY }} -Pgradle.publish.secret=${{ secrets.GRADLE_PORTAL_SECRET }} --stacktrace --warning-mode all
+          ./gradlew :plugin-maven:changelogPush -Prelease=true --stacktrace --warning-mode all
+      - name: publish just plugin-gradle
+        if: "${{ github.event.inputs.to_publish == 'plugin-gradle' }}"
+        run: |
+          ./gradlew :plugin-gradle:changelogPush -Prelease=true -Pgradle.publish.key=${{ secrets.GRADLE_PORTAL_KEY }} -Pgradle.publish.secret=${{ secrets.GRADLE_PORTAL_SECRET }} --stacktrace --warning-mode all
+      - name: publish just plugin-maven
+        if: "${{ github.event.inputs.to_publish == 'plugin-maven' }}"
+        run: |
+          ./gradlew :plugin-maven:changelogPush -Prelease=true --stacktrace --warning-mode all
+      - name: publish just lib
+        if: "${{ github.event.inputs.to_publish == 'lib' }}"
+        run: |
+          ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all
diff --git a/CHANGES.md b/CHANGES.md
index c7cde364c0..9ca16e4dc3 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -24,6 +24,8 @@ We adhere to the [keepachangelog](https://keepachangelog.com/en/1.0.0/) format (
   * `StepHarnessWithFile` now takes a `ResourceHarness` in its constructor to handle the file manipulation parts
   * Standardized that we test exception *messages*, not types, which will ease the transition to linting later on
   * Bump default `ktlint` version to latest `0.47.1` -> `0.48.1` ([#1456](https://github.com/diffplug/spotless/pull/1456))
+* Switch our publishing infrastructure from CircleCI to GitHub Actions ([#1462](https://github.com/diffplug/spotless/pull/1462)).
+  * Help wanted for moving our tests too ([#1472](https://github.com/diffplug/spotless/issues/1472))
 
 ## [2.31.1] - 2023-01-02
 ### Fixed