Migrate CI from CircleCI to GitHub Actions

[DevBaca]

Summary

• Replaces .circleci/config.yml with .github/workflows/ci.yaml
• Public repo, so this can't use the private smartrent/github-actions reusable workflows — uses public SHA-pinned actions (actions/checkout, erlef/setup-beam, actions/cache) instead
• Preserves the existing Elixir/OTP test matrix (1.16.2/26.2.4, 1.15.7/26.1.2, 1.14.5/25.3.2) and the "latest only" quality gate (format, unused deps, compile warnings-as-errors, credo, dialyzer, docs, hex.build)
• Updates README CI badge from CircleCI to GitHub Actions

Test plan

• Confirm the Elixir CI workflow triggers on this PR
• Confirm all 3 matrix jobs (1.16.2, 1.15.7, 1.14.5) pass mix deps.get + mix test
• Confirm the 1.16.2 (latest) job runs and passes format/credo/dialyzer/docs/hex.build checks

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	erlef/​setup-beam@​fc68ffb90438ef2936bbb3251622353b3dcb2f93
	actions/​cache@​27d5ce7f107fe9357f9df03efb73ab90386fccae

View full report

[socket-security]

Warning

Please read and follow SmartRent's Secure Development policy to resolve these alerts.

Reach out to security@smartrent.com if you have any questions.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Network access: github actions/cache Location: Package overview From: .github/workflows/ci.yaml → github/actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: github erlef/setup-beam Location: Package overview From: .github/workflows/ci.yaml → github/erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[stephanfenton]

LGTM