diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..e3195a1e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,95 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-22.04
+
+    services:
+      postgres:
+        image: postgres:14
+        env:
+          POSTGRES_USER: travis
+          POSTGRES_HOST_AUTH_METHOD: trust
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ['3.0', '3.1', '3.2', '3.3']
+
+    env:
+      PGPORT: 5432
+      PGUSER: travis
+      PGHOST: localhost
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: Install yarn dependencies
+        run: yarn install
+
+      - name: Run tests
+        run: bundle exec rake test
+
+  release:
+    needs: test
+    runs-on: ubuntu-22.04
+    if: github.ref == 'refs/heads/master'
+
+    permissions:
+      contents: write
+      id-token: write  # required for RubyGems trusted publishing
+
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
+          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.0'
+          bundler-cache: true
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - name: Install semantic-release
+        run: |
+          npm i -g \
+            semantic-release \
+            @semantic-release/git \
+            @semantic-release/changelog \
+            semantic-release-rubygem
+
+      - name: Configure RubyGems credentials
+        uses: rubygems/configure-rubygems-credentials@v1
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: ./release.sh
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 70c832d7..00000000
--- a/.travis.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-language: ruby
-dist: focal
-cache:
-- bundler
-- yarn
-
-# Travis pre-installs some Ruby versions. You can see the current list
-# by clicking on "Build system information" on line 7 which reveals a
-# section called "Pre-installed Ruby versions".  Use versions from
-# that list to not install rvm and ruby each time.
-rvm:
-- 3.0.1 # doesn't show in pre-installed list
-- 3.1.2
-- 3.2.0
-- 3.3.1
-
-addons:
-  postgresql: "14"
-  apt:
-    packages:
-    - postgresql-14
-    - postgresql-client-14
-env:
-  global:
-  - PGPORT=5433
-  - PGUSER=travis
-
-before_deploy:
-  - nvm install lts/*
-  - |
-    npm i -g \
-      semantic-release \
-      @semantic-release/git \
-      @semantic-release/changelog \
-      semantic-release-rubygem
-
-deploy:
-  - provider: script
-    script: ./release.sh
-    on:
-      branch: master
-      condition: "$TRAVIS_RUBY_VERSION =~ ^3.0"
diff --git a/README.md b/README.md
index 5b21a6b3..3baa28f1 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ granular than a full debug trace. It's designed to be optimal for understanding
 Visit the [AppMap for Ruby](https://appland.com/docs/reference/appmap-ruby.html) reference page on AppLand.com for a complete reference guide.
 
 # Development
-[![Build Status](https://travis-ci.com/getappmap/appmap-ruby.svg?branch=master)](https://travis-ci.com/getappmap/appmap-ruby)
+[![CI](https://github.com/getappmap/appmap-ruby/actions/workflows/ci.yml/badge.svg)](https://github.com/getappmap/appmap-ruby/actions/workflows/ci.yml)
 
 ## Internal architecture
 
diff --git a/README_CI.md b/README_CI.md
index 246b1949..c70e8541 100644
--- a/README_CI.md
+++ b/README_CI.md
@@ -1,17 +1,17 @@
 # Configuration variables:
 
-* `GH_TOKEN`: used by `semantic-release` to push changes to Github and manage releases
-* `GEM_HOST_API_KEY`: rubygems API key
-* `GEM_ALTERNATIVE_NAME` (optional): used for testing of CI flows, 
+* `RELEASE_BOT_APP_ID`, `RELEASE_BOT_PRIVATE_KEY`: GitHub App credentials used to generate a token for `semantic-release` to push changes to GitHub and manage releases
+* RubyGems publishing uses OIDC trusted publishing — no API key required
+* `GEM_ALTERNATIVE_NAME` (optional): used for testing of CI flows,
 to avoid publication of test releases under official package name
 
 # Release command
 
-`./release.sh` 
+`./release.sh`
 
-Bash wrapper script is used merely as a launcher of `semantic-release` 
-with extra logic to explicitly determine git url from `TRAVIS_REPO_SLUG` \
-variable if its defined (otherwise git url is taken from `package.json`, 
+Bash wrapper script is used merely as a launcher of `semantic-release`
+with extra logic to explicitly determine git url from `GITHUB_REPOSITORY` \
+variable if its defined (otherwise git url is taken from `package.json`,
 which breaks CI on forked repos).
 
 # CI flow
diff --git a/release.sh b/release.sh
index c4e81d7e..ce88de41 100755
--- a/release.sh
+++ b/release.sh
@@ -2,9 +2,9 @@
 # using bash wrapper as Rake blows up in `require/extentiontask` (line 10)
 
 RELEASE_FLAGS=""
-if [ ! -z "$TRAVIS_REPO_SLUG" ]; then
-    RELEASE_FLAGS="-r git+https://github.com/${TRAVIS_REPO_SLUG}.git"
-fi 
+if [ ! -z "$GITHUB_REPOSITORY" ]; then
+    RELEASE_FLAGS="-r git+https://github.com/${GITHUB_REPOSITORY}.git"
+fi
 
 if [ ! -z "$GEM_ALTERNATIVE_NAME" ]; then
     echo "Release: GEM_ALTERNATIVE_NAME=$GEM_ALTERNATIVE_NAME"
diff --git a/spec/fixtures/rails6_users_app/Gemfile b/spec/fixtures/rails6_users_app/Gemfile
index c21868dc..80d16335 100644
--- a/spec/fixtures/rails6_users_app/Gemfile
+++ b/spec/fixtures/rails6_users_app/Gemfile
@@ -12,6 +12,11 @@ gem 'sequel', '>= 5.43.0', require: false
 gem 'sequel-rails', require: false
 gem 'sequel_secure_password', require: false
 
+# pin to avoid uninitialized constant ActiveSupport::LoggerThreadSafeLevel::Logger
+gem 'concurrent-ruby', '1.3.4'
+
+gem 'mutex_m'
+
 group :development, :test do
   gem 'appmap', path: '../../..'
   gem 'cucumber-rails', require: false
diff --git a/spec/record_sql_rails_pg_spec.rb b/spec/record_sql_rails_pg_spec.rb
index 4aa94ab8..8668b588 100644
--- a/spec/record_sql_rails_pg_spec.rb
+++ b/spec/record_sql_rails_pg_spec.rb
@@ -29,15 +29,21 @@ def self.check_queries(cases)
       context 'with ActiveRecord' do
         before(:context) { run_specs 'activerecord' }
 
-        expected_query = if rails_version == 7
-                           %(INSERT INTO "users" ("login", "password_digest") VALUES ($1, $2) RETURNING "id")
-                         else
-                           %(INSERT INTO "users" ("login") VALUES ($1) RETURNING "id")
-                         end
+        expected_insert = if rails_version == 7
+                            %(INSERT INTO "users" ("login", "password_digest") VALUES ($1, $2) RETURNING "id")
+                          else
+                            %(INSERT INTO "users" ("login") VALUES ($1) RETURNING "id")
+                          end
+
+        expected_select = if rails_version >= 6
+                            %(SELECT * FROM "users")
+                          else
+                            %(SELECT "users".* FROM "users")
+                          end
 
         check_queries(
-          'Api_UsersController_POST_api_users_with_required_parameters_creates_a_user' => expected_query,
-          'Api_UsersController_GET_api_users_lists_the_users' => %(SELECT "users".* FROM "users")
+          'Api_UsersController_POST_api_users_with_required_parameters_creates_a_user' => expected_insert,
+          'Api_UsersController_GET_api_users_lists_the_users' => expected_select
         )
       end