use gha instead of circleci

[joshuafernandes]

Note

Medium Risk
Changes release automation and Cloudsmith publishing gates; mistakes could break builds or affect artifact publication, but no application/runtime crypto code is modified in this diff.

Overview
Adds a new GitHub Actions workflow at .github/workflows/ci.yml to replace CircleCI for building and publishing the jblst Java artifact with bundled native BLST libraries.

The pipeline runs on push/PR to master and semver tags, with parallel jobs for Linux x86_64, cross-compiled Linux ARM64, macOS (x86_64 + arm64 with arch directory fixes), and Windows (TDM GCC + Swig). Each platform job uploads native artifacts; an assemble job downloads them, copies generated Java/resources into src/main, runs ./gradlew build and checkJarContents, and stores the JAR plus workspace artifacts.

A gated publish job (protected publish environment, master / release-* / tags only) reuses the assembled workspace and runs checkJarContents publish to Cloudsmith using CLOUDSMITH_USER / CLOUDSMITH_API_KEY secrets.

^{Reviewed by Cursor Bugbot for commit e37e413. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Release branches never trigger CI

Medium Severity

The workflow on.push.branches list only includes master, but the publish job if still allows refs/heads/release-*. Pushes to release branches never start the workflow, so that publish path from the old CircleCI filters is unreachable.

Additional Locations (1)

• .github/workflows/ci.yml#L241-L245

 

^{Reviewed by Cursor Bugbot for commit 77a7bc3. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1256aeb. Configure here.}