diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
new file mode 100644
index 000000000..d90989f7d
--- /dev/null
+++ b/.github/workflows/python-package.yml
@@ -0,0 +1,140 @@
+name: CI
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches: [master]
+    tags:
+      - v[0-9]+.[0-9]+.[0-9]+*
+  pull_request:
+    branches: [master]
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python 3
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.10"
+      - name: lint
+        run: make lint
+      - name: fmtcheck
+        run: make fmtcheck
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Set up Python 3
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.10"
+
+      - name: Install tools
+        run: make venv
+
+      - name: Build and check package
+        run: |
+          set -x
+          source venv/bin/activate
+          python setup.py clean --all sdist bdist_wheel --universal
+          python -m twine check dist/*
+
+      - name: 'Upload Artifact'
+        uses: actions/upload-artifact@v2
+        with:
+          name: dist
+          path: dist/
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version:
+          [
+            "2.7",
+            "3.5",
+            "3.6",
+            "3.7",
+            "3.8",
+            "3.9",
+            "3.10",
+            "pypy-2.7",
+            "pypy-3.7",
+          ]
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v2
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Upgrade pip and virtualenv to latest
+        run: pip install --upgrade pip virtualenv
+
+      - name: Get pip cache dir
+        id: pip-cache
+        run: |
+          python -c "from pip._internal.locations import USER_CACHE_DIR; print('::set-output name=dir::' + USER_CACHE_DIR)"
+
+      - name: pip cache
+        uses: actions/cache@v2
+        with:
+          path: ${{ steps.pip-cache.outputs.dir }}
+          key: ${{ runner.os }}-pip-${{ hashFiles('setup.py') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      # Might be sensible to cache the docker image but this seems to be
+      # not fully supported by github actions yet, as of Feb 2021
+      # https://github.com/actions/cache/issues/81
+      - name: Start stripe-mock
+        run: docker run -d -p 12111-12112:12111-12112 stripe/stripe-mock && sleep 5
+
+      - name: Test with pytest
+        run: make test-gh-actions
+
+  publish:
+    name: Publish
+    if: (((github.event_name == 'workflow_dispatch')) && (github.ref == 'refs/branches/master' || startsWith(github.ref, 'refs/tags/v')) && endsWith(github.actor, '-stripe'))
+    needs: [build, test, lint]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Download all workflow run artifacts
+        uses: actions/download-artifact@v2
+        with:
+          name: dist
+          path: dist
+      - name: Set up Python 3
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.10"
+
+      - name: Configure GPG Key
+        run: |
+          set -x
+          echo -n "$GPG_SIGNING_PUBKEY$GPG_SIGNING_PRIVKEY" | gpg --import  --pinentry-mode loopback --batch --passphrase '${GPG_SIGNING_KEY_PASSWORD}'
+        env:
+          GPG_SIGNING_PUBKEY: ${{ secrets.GPG_SIGNING_PUBKEY }}
+          GPG_SIGNING_PRIVKEY: ${{ secrets.GPG_SIGNING_PRIVKEY }}
+          GPG_SIGNING_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
+      - name: Install tools
+        run: make venv
+      - name: Publish packages to PyPy
+        run: |
+          set -x
+          source venv/bin/activate
+          python -m twine upload --identity $GPG_SIGNING_KEYID --sign dist/*
+        env:
+          GPG_SIGNING_KEYID: ${{ secrets.GPG_SIGNING_KEYID }}
+          TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
+          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}