diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index a09bd3a8..00000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-version: 2
-jobs:
-  build-go1.11:
-    docker:
-        - image: golang:1.11
-        - image: postgres:9.6
-          environment:
-            POSTGRES_DB: micromdm
-            POSTGRES_USER: micromdm
-            POSTGRES_PASSWORD: micromdm
-
-    working_directory: /go/src/github.com/micromdm/micromdm
-    steps: &steps
-      - checkout
-      - run: apt-get update -y && apt-get install postgresql-client -y
-      - run: make deps
-      - run: GO111MODULE=on go install github.com/pressly/goose/cmd/goose
-      - run: make db-reset-test
-      - run: make db-migrate-test
-      - run: make test
-      - run: make
-
-workflows:
-  version: 2
-  build:
-    jobs:
-      - build-go1.11
diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
new file mode 100644
index 00000000..362f1cf0
--- /dev/null
+++ b/.github/workflows/CI.yml
@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+jobs:
+  build-test:
+    name: Build, test & format
+    strategy:
+      matrix:
+        go-version: [1.15.x, 1.16.x]
+        platform: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.platform }}
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: setup go
+      uses: actions/setup-go@v2
+      with:
+        go-version: ${{ matrix.go-version }}
+
+    - name: Build
+      run: go build -v ./...
+
+    - name: Test
+      run: go test -v ./...
+
+    - name: Format
+      if: matrix.platform == 'ubuntu-latest'
+      run: if [ "$(gofmt -s -l . | wc -l)" -gt 0 ]; then exit 1; fi
diff --git a/Makefile b/Makefile
index 37e874b5..79c30000 100644
--- a/Makefile
+++ b/Makefile
@@ -58,6 +58,10 @@ deps: gomodcheck
 	@go mod download
 
 test:
+	go test -cover ./...
+
+# don't run race tests by default. see https://github.com/etcd-io/bbolt/issues/187
+test-race:
 	go test -cover -race ./...
 
 build: micromdm mdmctl
diff --git a/cmd/mdmctl/mdmcert.go b/cmd/mdmctl/mdmcert.go
index be00091c..b806805e 100644
--- a/cmd/mdmctl/mdmcert.go
+++ b/cmd/mdmctl/mdmcert.go
@@ -164,12 +164,12 @@ func (cmd *mdmcertCommand) runPush(args []string) error {
 	flagset := flag.NewFlagSet("push", flag.ExitOnError)
 	flagset.Usage = usageFor(flagset, "mdmctl mdmcert push [flags]")
 	var (
-		flEmail    = flagset.String("email", "", "Email address to use in CSR Subject.")
-		flCountry  = flagset.String("country", "US", "Two letter country code for the CSR Subject(Example: US).")
-		flCN       = flagset.String("cn", "micromdm-user", "CommonName for the CSR Subject.")
-		flPKeyPass = flagset.String("password", "", "Password to encrypt/read the RSA key.")
-		flKeyPath  = flagset.String("private-key", filepath.Join(mdmcertdir, pushCertificatePrivateKeyFilename), "Path to the push certificate private key. A new RSA key will be created at this path.")
-		flLocalOnly= flagset.Bool("local-only",false,"No server configuration required.")
+		flEmail     = flagset.String("email", "", "Email address to use in CSR Subject.")
+		flCountry   = flagset.String("country", "US", "Two letter country code for the CSR Subject(Example: US).")
+		flCN        = flagset.String("cn", "micromdm-user", "CommonName for the CSR Subject.")
+		flPKeyPass  = flagset.String("password", "", "Password to encrypt/read the RSA key.")
+		flKeyPath   = flagset.String("private-key", filepath.Join(mdmcertdir, pushCertificatePrivateKeyFilename), "Path to the push certificate private key. A new RSA key will be created at this path.")
+		flLocalOnly = flagset.Bool("local-only", false, "No server configuration required.")
 
 		flCSRPath = flagset.String("out", filepath.Join(mdmcertdir, pushCSRFilename), "Path to save the MDM Push Certificate request.")
 	)
@@ -178,10 +178,10 @@ func (cmd *mdmcertCommand) runPush(args []string) error {
 		return err
 	}
 
-    if !*flLocalOnly {
-        if err := cmd.setup(); err != nil {
-    		return err
-   		}
+	if !*flLocalOnly {
+		if err := cmd.setup(); err != nil {
+			return err
+		}
 	}
 	if err := os.MkdirAll(filepath.Dir(*flCSRPath), 0755); err != nil {
 		errors.Wrapf(err, "create directory %s", filepath.Dir(*flCSRPath))
diff --git a/mdm/mdm/command.go b/mdm/mdm/command.go
index e10ad4cb..dbbd9f9b 100644
--- a/mdm/mdm/command.go
+++ b/mdm/mdm/command.go
@@ -217,7 +217,7 @@ type Setting struct {
 	DeviceName              *string                `plist:",omitempty" json:"device_name,omitempty"`
 	HostName                *string                `plist:",omitempty" json:"hostname,omitempty"`
 	Identifier              *string                `plist:",omitempty" json:"identifier"`
-	TimeZone              	*string                `plist:",omitempty" json:"time_zone,omitempty"`
+	TimeZone                *string                `plist:",omitempty" json:"time_zone,omitempty"`
 	Attributes              map[string]string      `plist:",omitempty" json:"attributes,omitempty"`
 	Image                   []byte                 `plist:",omitempty" json:"image,omitempty"`
 	Where                   *int                   `plist:",omitempty" json:"where,omitempty"`
diff --git a/mdm/mdm/marshal_proto.go b/mdm/mdm/marshal_proto.go
index 8c207fd4..bb133cc8 100644
--- a/mdm/mdm/marshal_proto.go
+++ b/mdm/mdm/marshal_proto.go
@@ -441,7 +441,7 @@ func settingToProto(s Setting) *mdmproto.Setting {
 		pbs.TimeZone = &mdmproto.TimeZoneSetting{
 			TimeZone: emptyStringIfNil(s.TimeZone),
 		}
-		case "HostName":
+	case "HostName":
 		pbs.Hostname = &mdmproto.HostnameSetting{
 			Hostname: emptyStringIfNil(s.HostName),
 		}
diff --git a/platform/apns/pg/pg_test.go b/platform/apns/pg/pg_test.go
index a7e1e1d2..0a906100 100644
--- a/platform/apns/pg/pg_test.go
+++ b/platform/apns/pg/pg_test.go
@@ -1,3 +1,5 @@
+// +build pg
+
 package pg
 
 import (
diff --git a/platform/apns/service.go b/platform/apns/service.go
index 13134c6f..01e4872e 100644
--- a/platform/apns/service.go
+++ b/platform/apns/service.go
@@ -136,7 +136,7 @@ func newClient(cert tls.Certificate) (*http.Client, error) {
 	}
 	config.BuildNameToCertificate()
 	transport := &http.Transport{
-		Proxy: http.ProxyFromEnvironment,
+		Proxy:           http.ProxyFromEnvironment,
 		TLSClientConfig: config,
 		IdleConnTimeout: 90 * time.Second,
 	}
diff --git a/platform/blueprint/blueprint.go b/platform/blueprint/blueprint.go
index c0088171..a309be83 100644
--- a/platform/blueprint/blueprint.go
+++ b/platform/blueprint/blueprint.go
@@ -43,7 +43,7 @@ func MarshalBlueprint(bp *Blueprint) ([]byte, error) {
 		UserUuid:                            bp.UserUUID,
 		SkipPrimarySetupAccountCreation:     bp.SkipPrimarySetupAccountCreation,
 		SetPrimarySetupAccountAsRegularUser: bp.SetPrimarySetupAccountAsRegularUser,
-		ApplyAt: bp.ApplyAt,
+		ApplyAt:                             bp.ApplyAt,
 	}
 	return proto.Marshal(&protobp)
 }
diff --git a/platform/device/pg/pg_test.go b/platform/device/pg/pg_test.go
index aa45f41b..5abef451 100644
--- a/platform/device/pg/pg_test.go
+++ b/platform/device/pg/pg_test.go
@@ -1,3 +1,5 @@
+// +build pg
+
 package pg
 
 import (