diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..ee593675
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..5e9ecaa5
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,108 @@
+name: Continuous Test + Deploy
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*.*.*"]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python 3.8
+      uses: actions/setup-python@v2
+      with:
+        # pytype currently doesn't work with python >= 3.9
+        python-version: 3.8
+    # - name: Install tox
+    #   run: pip install tox
+    # - name: Run style and typing checks
+    #   run: tox -e lint
+  test:
+    runs-on: ${{ matrix.platform }}
+    strategy:
+      matrix:
+        python-version: [3.7, 3.8, 3.9]
+        platform: [ubuntu-latest]
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v2
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Requirements
+      run: pip install -r requirements.txt
+    - name: Install
+      run: pip install -e .
+    - name: Run the tests
+      run: ./precommit.sh
+  deploy:
+    # only run if the commit is tagged...
+    if: startsWith(github.ref, 'refs/tags/v')
+    # ... and both the lint and test jobs completed successfully
+    needs:
+      - lint
+      - test
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        # setuptools_scm requires the git clone to not be 'shallow'
+        fetch-depth: 0
+    - name: Set up Python
+      uses: actions/setup-python@v2
+      with:
+        python-version: "3.x"
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install setuptools wheel twine
+    - name: Extract release notes from annotated tag message
+      id: release_notes
+      env:
+        # e.g. v0.1.0a1, v1.2.0b2 or v2.3.0rc3, but not v1.0.0
+        PRERELEASE_TAG_PATTERN: "v[[:digit:]]+\\.[[:digit:]]+\\.[[:digit:]]+([ab]|rc)[[:digit:]]+"
+      run: |
+        # GH checkout action doesn't preserve tag annotations, we must fetch them
+        # https://github.com/actions/checkout/issues/290
+        git fetch --tags --force
+        # strip leading 'refs/tags/' to get the tag name
+        TAG_NAME="${GITHUB_REF##*/}"
+        # Dump tag message to temporary .md file (excluding the PGP signature at the bottom)
+        TAG_MESSAGE=$(git tag -l --format='%(contents)' $TAG_NAME | sed -n '/-----BEGIN PGP SIGNATURE-----/q;p')
+        echo "$TAG_MESSAGE" > "${{ runner.temp }}/release_notes.md"
+        # if the tag has a pre-release suffix mark the Github Release accordingly
+        if egrep -q "$PRERELEASE_TAG_PATTERN" <<< "$TAG_NAME"; then
+          echo "Tag contains a pre-release suffix"
+          echo "IS_PRERELEASE=true" >> "$GITHUB_ENV"
+        else
+          echo "Tag does not contain pre-release suffix"
+          echo "IS_PRERELEASE=false" >> "$GITHUB_ENV"
+        fi
+    - name: Create GitHub release
+      id: create_release
+      uses: actions/create-release@v1
+      env:
+        # This token is provided by Actions, you do not need to create your own token
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        tag_name: ${{ github.ref }}
+        release_name: ${{ github.ref }}
+        body_path: "${{ runner.temp }}/release_notes.md"
+        draft: false
+        prerelease: ${{ env.IS_PRERELEASE }}
+    - name: Build and publish
+      env:
+        TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
+        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
+      run: |
+        if [ "$IS_PRERELEASE" == true ]; then
+          echo "DEBUG: This is a pre-release"
+        else
+          echo "DEBUG: This is a final release"
+        fi
+        python setup.py sdist bdist_wheel
+        twine upload dist/*
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 46d593f2..00000000
--- a/.travis.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-sudo: required
-language: python
-dist: xenial
-python:
-- '3.7'
-install:
-- python --version
-- pip install --upgrade pip
-- pip install -r requirements.txt
-- pip install -e .
-- sudo apt-get install libc6:i386 libncurses5:i386 libstdc++6:i386
-script:
-- (cd tests && ./run_tests)
-deploy:
-  provider: pypi
-  user: __token__
-  password:
-    secure: dIjxrjnwuoUn0DgofxpLQGYaTJAapYm2Q11L5oQbPfEe59nZ11mngNtusSboMNBpoAzXa5UxpcnbaDtgRD2y2MXFTGomDhU0x2nKE+3akwLmXmfQ7ZyE3m18HBSVGkZYQ92u1x+60eGx0pew9K6XaXj60ttHw3XaqVNXtNtqJvw0r9jj6PgbKYfNb+xZ8GrYIab9Po40FxpC0ISMsk4I/UpGLXNsGWXIOWya2LkjgXkZ3r2nDPoy4ROPRpDGAEBsP/nE7hbg+hS9l7TiY34sLbrak1fzBx4uQl2P7wN//hIsOwseLojsWvUfjcEnVaGhBSnrZWES76C62w0/r9UHi/hgDoFbw121BenNKuFqv18Xro3wOJYgk/7DdUwUaNewUfpHQ+AhtKkz6dBRt6dI0Cj/Kn/PzaiM+iQ4g5fBNb5MWiqs8XleJmv5AoCHCmeIixW3WgOzrEgDTgDI/BhwLsdgYBibSKCPVOvWTRTncVwSoiT3mPchJJQaARL+B4gyebj04WUMqQ2zylfQFXdeTmxoVDl2iNFfYo17kzsfBj3/ldAbdQbu0oPglwbU9olTQT0Jx0yPDcFz14fyYQaIvOhScof1hs5/BNhH2aLUL1axGKrpOTOWWCSEGhUP8KKRahycArJfHH5Ucm089SjS9fGAGDVG2eAdyh3Q3+o0ud8=
-  on:
-    tags: true
-    condition: "$TRAVIS_PYTHON_VERSION = 3.7"
-  distributions: sdist bdist_wheel
-  skip_existing: true
diff --git a/README.md b/README.md
index 383b563d..dae2eea4 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
-[![Travis Build Status](https://travis-ci.org/googlefonts/nototools.svg?branch=master)](https://travis-ci.org/googlefonts/nototools)
+[![CI Build Status](https://github.com/googlefonts/nototools/workflows/Continuous%20Test%20+%20Deploy/badge.svg)](https://github.com/googlefonts/picosvg/actions/workflows/ci.yml?query=workflow%3ATest)
 [![PyPI](https://img.shields.io/pypi/v/notofonttools.svg)](https://pypi.org/project/notofonttools/)
-[![pyup](https://pyup.io/repos/github/googlefonts/nototools/shield.svg)](https://pyup.io/repos/github/googlefonts/nototools)
+[![Dependencies](https://badgen.net/github/dependabot/googlefonts/nototools)](https://github.com/googlefonts/nototools/network/updates)
+
 
 # Noto Tools
 
diff --git a/requirements.txt b/requirements.txt
index c1d58d8b..0e2fcb09 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -23,7 +23,7 @@ regex==2020.5.14
 scour==0.37
 six==1.15.0
 toml==0.10.1
-typed-ast==1.4.1
+typed-ast>=1.4.2
 ufonormalizer==0.4.1
 ufoProcessor==1.9.0
 unicodedata2==13.0.0.post2