diff --git a/.ci/build.sh b/.ci/build.sh
deleted file mode 100755
index 2b0931d..0000000
--- a/.ci/build.sh
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/env bash
-
-# Exit this script immediately if a command/function exits with a non-zero status.
-set -e
-
-SCRIPT_INCLUDES="log.bash utils.bash setup-secrets.bash openjdk.bash github-releases-api.bash"
-# shellcheck source=inc/fetch_ci_scripts.bash
-source "$(dirname "$0")/inc/fetch_ci_scripts.bash" && fetch_ci_scripts
-
-function build() {
-    pmd_ci_log_group_start "Install OpenJDK 8+11"
-        pmd_ci_openjdk_install_adoptium 11
-        pmd_ci_openjdk_install_adoptium 8
-        pmd_ci_openjdk_setdefault 11
-    pmd_ci_log_group_end
-
-    pmd_ci_log_group_start "Install dependencies"
-        # bundler should already be installed
-        bundle --version
-        bundle config set --local path vendor/bundle
-        bundle install
-    pmd_ci_log_group_end
-
-    echo
-    local version
-    version="$(bundle exec ruby -I. -e 'require "lib/pmdtester"; print PmdTester::VERSION;')"
-    pmd_ci_log_info "======================================================================="
-    pmd_ci_log_info "Building pmd-regression-tester ${version}"
-    pmd_ci_log_info "======================================================================="
-    pmd_ci_utils_determine_build_env pmd/pmd-regression-tester
-    echo
-
-    pmd_ci_log_group_start "Build with rake"
-        bundle exec rake check_manifest
-        bundle exec rake rubocop
-        bundle exec rake clean test
-    pmd_ci_log_group_end
-
-    pmd_ci_log_group_start "Run Integration Tests"
-        bundle exec rake clean integration-test
-    pmd_ci_log_group_end
-
-    pmd_ci_log_group_start "Build Package"
-        bundle exec rake install_gem
-        bundle exec pmdtester -h
-    pmd_ci_log_group_end
-
-    if pmd_ci_utils_is_fork_or_pull_request; then
-        # builds on forks or builds for pull requests stop here
-        exit 0
-    fi
-
-    # only builds on pmd/pmd-regression-tester continue here
-    pmd_ci_log_group_start "Setup environment"
-        pmd_ci_setup_secrets_private_env
-    pmd_ci_log_group_end
-
-    if isReleaseBuild "$version"; then
-        pmd_ci_log_group_start "Publish to rubygems"
-            gem build pmdtester.gemspec
-            local gempkgfile
-            gempkgfile="$(echo pmdtester-*.gem)"
-            gem push "${gempkgfile}"
-        pmd_ci_log_group_end
-
-        pmd_ci_log_group_start "Update Github Releases"
-            # create a draft github release
-            pmd_ci_gh_releases_createDraftRelease "${PMD_CI_TAG}" "$(git rev-list -n 1 "${PMD_CI_TAG}")"
-            GH_RELEASE="$RESULT"
-
-            # Deploy to github releases
-            pmd_ci_gh_releases_uploadAsset "$GH_RELEASE" "${gempkgfile}"
-
-            # extract the release notes
-            RELEASE_NAME="${version}"
-            BEGIN_LINE=$(grep -n "^# " History.md|head -1|cut -d ":" -f 1)
-            BEGIN_LINE=$((BEGIN_LINE + 1))
-            END_LINE=$(grep -n "^# " History.md|head -2|tail -1|cut -d ":" -f 1)
-            END_LINE=$((END_LINE - 1))
-            RELEASE_BODY="$(head -$END_LINE History.md | tail -$((END_LINE - BEGIN_LINE)))"
-
-            pmd_ci_gh_releases_updateRelease "$GH_RELEASE" "$RELEASE_NAME" "$RELEASE_BODY"
-
-            # Publish release - this sends out notifications on github
-            pmd_ci_gh_releases_publishRelease "$GH_RELEASE"
-        pmd_ci_log_group_end
-    fi
-}
-
-function isReleaseBuild() {
-    local version="$1"
-
-    if [[ "${version}" != *-SNAPSHOT && "${PMD_CI_TAG}" != "" ]]; then
-        return 0
-    fi
-
-    return 1
-}
-
-build
diff --git a/.ci/inc/fetch_ci_scripts.bash b/.ci/inc/fetch_ci_scripts.bash
deleted file mode 100644
index 835fe67..0000000
--- a/.ci/inc/fetch_ci_scripts.bash
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-function fetch_ci_scripts() {
-    local inc_dir
-    local inc_url
-    inc_dir="$(dirname "$0")/inc"
-    inc_url="${PMD_CI_SCRIPTS_URL:-https://raw.githubusercontent.com/pmd/build-tools/main/scripts}/inc"
-
-    mkdir -p "${inc_dir}"
-
-    for f in ${SCRIPT_INCLUDES}; do
-        if [ ! -e "${inc_dir}/$f" ]; then
-            curl -sSL "${inc_url}/$f" > "${inc_dir}/$f"
-        fi
-        [ "$PMD_CI_DEBUG" = "true" ] && echo "loading ${inc_dir}/$f in ${MODULE:-$0}"
-        # shellcheck source=/dev/null
-        source "${inc_dir}/$f" || exit 1
-    done
-}
diff --git a/.ci/manual-integration-tests.sh b/.ci/manual-integration-tests.sh
deleted file mode 100755
index 4fcacb0..0000000
--- a/.ci/manual-integration-tests.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-
-# Exit this script immediately if a command/function exits with a non-zero status.
-set -e
-
-SCRIPT_INCLUDES="log.bash utils.bash openjdk.bash"
-# shellcheck source=inc/fetch_ci_scripts.bash
-source "$(dirname "$0")/inc/fetch_ci_scripts.bash" && fetch_ci_scripts
-
-function build() {
-    pmd_ci_log_group_start "Install OpenJDK 8+11"
-        pmd_ci_openjdk_install_adoptium 11
-        pmd_ci_openjdk_install_adoptium 8
-        pmd_ci_openjdk_setdefault 11
-    pmd_ci_log_group_end
-
-    pmd_ci_log_group_start "Install dependencies"
-        # bundler should already be installed
-        bundle --version
-        bundle config set --local path vendor/bundle
-        bundle install
-    pmd_ci_log_group_end
-
-    echo
-    local version
-    version="$(bundle exec ruby -I. -e 'require "lib/pmdtester"; print PmdTester::VERSION;')"
-    pmd_ci_log_info "======================================================================="
-    pmd_ci_log_info "Building pmd-regression-tester ${version}"
-    pmd_ci_log_info "======================================================================="
-    pmd_ci_utils_determine_build_env pmd/pmd-regression-tester
-    echo
-
-    pmd_ci_log_group_start "Run Manual Integration Tests"
-        bundle exec ruby -I test test/manual_integration_tests.rb
-    pmd_ci_log_group_end
-}
-
-build
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1123d8e..47c635c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,57 +1,75 @@
-name: build
+name: Build
 
 on:
+  pull_request:
+  merge_group:
   push:
     branches:
-      - main
-    tags:
       - '**'
-  pull_request:
+      # don't run on dependabot branches. Dependabot will create pull requests, which will then be run instead
+      - '!dependabot/**'
+  workflow_dispatch:
   schedule:
     # build it monthly: At 04:30 on day-of-month 1.
     - cron:  '30 4 1 * *'
-  workflow_dispatch:
+
+# if another commit is added to the same branch or PR (same github.ref),
+# then cancel already running jobs and start a new build.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
+env:
+  LANG: 'en_US.UTF-8'
 
 jobs:
-  build:
-    timeout-minutes: 120
+  compile:
     runs-on: ubuntu-latest
-    continue-on-error: false
-    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
+    timeout-minutes: 120
+    defaults:
+      run:
+        shell: bash
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache@v4
-      with:
-        path: |
-          ~/.m2/repository
-          ~/.cache
-          ~/.gradle
-          vendor/bundle
-          target/repositories
-        key: v3-${{ runner.os }}-${{ hashFiles('pmdtester.gemspec') }}
-        restore-keys: |
-          v3-${{ runner.os }}-
-    - name: Set up Ruby 3.3
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: 3.3
-    - name: Setup Environment
-      shell: bash
-      run: |
-        echo "LANG=en_US.UTF-8" >> $GITHUB_ENV
-        echo "MAVEN_OPTS=-Dmaven.wagon.httpconnectionManager.ttlSeconds=180 -Dmaven.wagon.http.retryHandler.count=3" >> $GITHUB_ENV
-        echo "PMD_CI_SCRIPTS_URL=https://raw.githubusercontent.com/pmd/build-tools/main/scripts" >> $GITHUB_ENV
-    - name: Check Environment
-      shell: bash
-      run: |
-        f=check-environment.sh; \
-        mkdir -p .ci && \
-        ( [ -e .ci/$f ] || curl -sSL "${PMD_CI_SCRIPTS_URL}/$f" > ".ci/$f" ) && \
-        chmod 755 .ci/$f && \
-        .ci/$f
-    - name: Build
-      run: .ci/build.sh
-      shell: bash
-      env:
-        PMD_CI_SECRET_PASSPHRASE: ${{ secrets.PMD_CI_SECRET_PASSPHRASE }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+      - name: Prepare HOME/openjdk11
+        run: ln -sfn "${JAVA_HOME_11_X64}" "${HOME}/openjdk11"
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.m2/repository
+            ~/.cache
+            ~/.gradle
+            vendor/bundle
+            target/repositories
+          key: v4-${{ runner.os }}-${{ hashFiles('pmdtester.gemspec') }}
+          restore-keys: |
+            v4-${{ runner.os }}-
+      - name: Set up Ruby 3.3
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.3
+      - name: Install dependencies (bundler)
+        run: |
+          # bundler should already be installed
+          bundle --version
+          bundle config set --local path vendor/bundle
+          bundle install
+      - name: Build with rake
+        run: |
+          bundle exec rake check_manifest
+          bundle exec rake rubocop
+          bundle exec rake clean test
+      - name: Run Integration Tests
+        run: |
+          bundle exec rake clean integration-test
+      - name: Build Package
+        run: |
+          bundle exec rake install_gem
+          bundle exec pmdtester -h
diff --git a/.github/workflows/manual-integration-tests.yml b/.github/workflows/manual-integration-tests.yml
index 438cf66..082ebb6 100644
--- a/.github/workflows/manual-integration-tests.yml
+++ b/.github/workflows/manual-integration-tests.yml
@@ -6,45 +6,46 @@ on:
     - cron:  '30 8 1 * *'
   workflow_dispatch:
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
+env:
+  LANG: 'en_US.UTF-8'
+
 jobs:
   build:
     timeout-minutes: 120
     runs-on: ubuntu-latest
     continue-on-error: false
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache@v4
-      with:
-        path: |
-          ~/.m2/repository
-          ~/.cache
-          ~/.gradle
-          vendor/bundle
-          target/repositories
-        key: v3-${{ runner.os }}-${{ hashFiles('pmdtester.gemspec') }}
-        restore-keys: |
-          v3-${{ runner.os }}-
-    - name: Set up Ruby 3.3
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: 3.3
-    - name: Setup Environment
-      shell: bash
-      run: |
-        echo "LANG=en_US.UTF-8" >> $GITHUB_ENV
-        echo "MAVEN_OPTS=-Dmaven.wagon.httpconnectionManager.ttlSeconds=180 -Dmaven.wagon.http.retryHandler.count=3" >> $GITHUB_ENV
-        echo "PMD_CI_SCRIPTS_URL=https://raw.githubusercontent.com/pmd/build-tools/main/scripts" >> $GITHUB_ENV
-    - name: Check Environment
-      shell: bash
-      run: |
-        f=check-environment.sh; \
-        mkdir -p .ci && \
-        ( [ -e .ci/$f ] || curl -sSL "${PMD_CI_SCRIPTS_URL}/$f" > ".ci/$f" ) && \
-        chmod 755 .ci/$f && \
-        .ci/$f
-    - name: Build
-      run: .ci/manual-integration-tests.sh
-      shell: bash
-      env:
-        PMD_CI_SECRET_PASSPHRASE: ${{ secrets.PMD_CI_SECRET_PASSPHRASE }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+      - name: Prepare HOME/openjdk11
+        run: ln -sfn "${JAVA_HOME_11_X64}" "${HOME}/openjdk11"
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.m2/repository
+            ~/.cache
+            ~/.gradle
+            vendor/bundle
+            target/repositories
+          key: v4-${{ runner.os }}-${{ hashFiles('pmdtester.gemspec') }}
+          restore-keys: |
+            v4-${{ runner.os }}-
+      - name: Set up Ruby 3.3
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.3
+      - name: Install dependencies (bundler)
+        run: |
+          # bundler should already be installed
+          bundle --version
+          bundle config set --local path vendor/bundle
+          bundle install
+      - name: Run Manual Integration Tests
+        run: |
+          bundle exec ruby -I test test/manual_integration_tests.rb
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
new file mode 100644
index 0000000..69df3ba
--- /dev/null
+++ b/.github/workflows/publish-release.yml
@@ -0,0 +1,140 @@
+name: Publish Release
+
+on:
+  workflow_run:
+    workflows: [Build]
+    types:
+      - completed
+    branches:
+      - '**'
+
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
+env:
+  LANG: 'en_US.UTF-8'
+
+jobs:
+  check-version:
+    # only run in the official pmd/pmd-regression-tester repo, where we have access to the secrets and not on forks
+    # and only run for _successful_ push workflow runs on tags "releases/**".
+    if: ${{ github.repository == 'pmd/pmd-regression-tester'
+      && contains(fromJSON('["push", "workflow_dispatch"]'), github.event.workflow_run.event)
+      && github.event.workflow_run.head_branch != 'main'
+      && github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        shell: bash
+    outputs:
+      VERSION: ${{ steps.version.outputs.VERSION }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_branch }}
+      - name: Set up Ruby 3.3
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.3
+      - name: Install dependencies (bundler)
+        run: |
+          # bundler should already be installed
+          bundle --version
+          bundle config set --local path vendor/bundle
+          bundle install
+      - name: Determine Version
+        id: version
+        env:
+          REF: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          if ! git show-ref --exists "refs/tags/$REF"; then
+            echo "::error ::Tag $REF does not exist, aborting."
+            exit 1
+          fi
+          
+          VERSION="$(bundle exec ruby -I. -e 'require "lib/pmdtester"; print PmdTester::VERSION;')"
+          echo "Determined VERSION=$VERSION"
+          if [[ "$VERSION" = *-SNAPSHOT ]]; then
+            echo "::error ::VERSION=$VERSION is a snapshot version, aborting."
+            exit 1
+          fi
+          echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
+      - name: Add Job Summary
+        env:
+          WORKFLOW_RUN_DISPLAY_TITLE: ${{ github.event.workflow_run.display_title }}
+          WORKFLOW_RUN_NAME: ${{ github.event.workflow_run.name }}
+          WORKFLOW_RUN_NUMBER: ${{ github.event.workflow_run.run_number }}
+          WORKFLOW_RUN_HTML_URL: ${{ github.event.workflow_run.html_url }}
+          VERSION: ${{ steps.version.outputs.VERSION }}
+          TAG: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          echo "### Run Info" >> "${GITHUB_STEP_SUMMARY}"
+          echo "Building Version: ${VERSION}" >> "${GITHUB_STEP_SUMMARY}"
+          echo "" >> "${GITHUB_STEP_SUMMARY}"
+          echo "Tag: ${TAG}" >> "${GITHUB_STEP_SUMMARY}"
+          echo "" >> "${GITHUB_STEP_SUMMARY}"
+          echo "Called by [${WORKFLOW_RUN_DISPLAY_TITLE} (${WORKFLOW_RUN_NAME} #${WORKFLOW_RUN_NUMBER})](${WORKFLOW_RUN_HTML_URL})" >> "${GITHUB_STEP_SUMMARY}"
+          echo "" >> "${GITHUB_STEP_SUMMARY}"
+
+  publish-to-rubygems:
+    needs: check-version
+    # use environment rubygems, where secrets are configured for GEM_HOST_API_KEY
+    environment:
+      name: rubygems
+      url: https://rubygems.org/gems/pmdtester
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # to create a release (via gh cli)
+    timeout-minutes: 20
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Set up Ruby 3.3
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.3
+      - name: Install dependencies (bundler)
+        run: |
+          # bundler should already be installed
+          bundle --version
+          bundle config set --local path vendor/bundle
+          bundle install
+      - name: Build with rake
+        run: |
+          bundle exec rake check_manifest
+          bundle exec rake rubocop
+          bundle exec rake clean test
+      - name: Build Package
+        run: |
+          bundle exec rake install_gem
+      - name: Publish to rubygems
+        env:
+          GEM_HOST_API_KEY: ${{ secrets.GEM_HOST_API_KEY }}
+        run: |
+          gem build pmdtester.gemspec
+          gempkgfile="$(echo pmdtester-*.gem)"
+          gem push "${gempkgfile}"
+      - name: Create GitHub Release
+        env:
+          # Token required for GH CLI:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ github.event.workflow_run.head_branch }}
+          VERSION: ${{ needs.check-version.outputs.VERSION }}
+        run: |
+          # extract the release notes
+          RELEASE_NAME="${VERSION}"
+          BEGIN_LINE=$(grep -n "^# " History.md|head -1|cut -d ":" -f 1)
+          BEGIN_LINE=$((BEGIN_LINE + 1))
+          END_LINE=$(grep -n "^# " History.md|head -2|tail -1|cut -d ":" -f 1)
+          END_LINE=$((END_LINE - 1))
+          RELEASE_BODY="$(head -$END_LINE History.md | tail -$((END_LINE - BEGIN_LINE)))"
+          echo "${RELEASE_BODY}" > release_notes.md
+
+          gempkgfile="$(echo pmdtester-*.gem)"
+
+          gh release create "$TAG_NAME" "${gempkgfile}" \
+              --verify-tag \
+              --notes-file release_notes.md \
+              --title "$RELEASE_NAME"
diff --git a/Manifest.txt b/Manifest.txt
index 2fe4dcd..a4955e8 100644
--- a/Manifest.txt
+++ b/Manifest.txt
@@ -1,8 +1,6 @@
-.ci/build.sh
-.ci/inc/fetch_ci_scripts.bash
-.ci/manual-integration-tests.sh
 .github/workflows/build.yml
 .github/workflows/manual-integration-tests.yml
+.github/workflows/publish-release.yml
 .gitignore
 .hoerc
 .rubocop.yml
diff --git a/test/resources/integration_test_pmd_report_builder/project-test.xml b/test/resources/integration_test_pmd_report_builder/project-test.xml
index 0955740..26e3bca 100644
--- a/test/resources/integration_test_pmd_report_builder/project-test.xml
+++ b/test/resources/integration_test_pmd_report_builder/project-test.xml
@@ -21,7 +21,7 @@ fi
 
 set -e
 
-# Make sure to use java11. This is already installed by build.sh
+# Make sure to use java11. This is already installed by setup-java.
 export JAVA_HOME=${HOME}/openjdk11
 export PATH=$JAVA_HOME/bin:$PATH
 
diff --git a/test/resources/integration_test_runner/project-list-single.xml b/test/resources/integration_test_runner/project-list-single.xml
index b37ee8c..f827238 100644
--- a/test/resources/integration_test_runner/project-list-single.xml
+++ b/test/resources/integration_test_runner/project-list-single.xml
@@ -21,7 +21,7 @@ fi
 
 set -e
 
-# Make sure to use java11. This is already installed by build.sh
+# Make sure to use java11. This is already installed by setup-java.
 export JAVA_HOME=${HOME}/openjdk11
 export PATH=$JAVA_HOME/bin:$PATH
 
diff --git a/test/resources/integration_test_runner/project-list-with-apex.xml b/test/resources/integration_test_runner/project-list-with-apex.xml
index 4c843ee..36637e9 100644
--- a/test/resources/integration_test_runner/project-list-with-apex.xml
+++ b/test/resources/integration_test_runner/project-list-with-apex.xml
@@ -21,7 +21,7 @@ fi
 
 set -e
 
-# Make sure to use java11. This is already installed by build.sh
+# Make sure to use java11. This is already installed by setup-java.
 export JAVA_HOME=${HOME}/openjdk11
 export PATH=$JAVA_HOME/bin:$PATH
 
diff --git a/test/resources/integration_test_runner/project-list.xml b/test/resources/integration_test_runner/project-list.xml
index 567cd31..f6b8634 100644
--- a/test/resources/integration_test_runner/project-list.xml
+++ b/test/resources/integration_test_runner/project-list.xml
@@ -21,7 +21,7 @@ fi
 
 set -e
 
-# Make sure to use java11. This is already installed by build.sh
+# Make sure to use java11. This is already installed by setup-java.
 export JAVA_HOME=${HOME}/openjdk11
 export PATH=$JAVA_HOME/bin:$PATH
 
diff --git a/test/resources/integration_test_runner/project-test.xml b/test/resources/integration_test_runner/project-test.xml
index 0955740..26e3bca 100644
--- a/test/resources/integration_test_runner/project-test.xml
+++ b/test/resources/integration_test_runner/project-test.xml
@@ -21,7 +21,7 @@ fi
 
 set -e
 
-# Make sure to use java11. This is already installed by build.sh
+# Make sure to use java11. This is already installed by setup-java.
 export JAVA_HOME=${HOME}/openjdk11
 export PATH=$JAVA_HOME/bin:$PATH