CI Migration - Bitrise to GHA

[marcantoineg]

This PR migrates the project’s CI pipeline from Bitrise to GitHub Actions.

What was done

• Replaces Bitrise CI with GitHub Actions for formatting, linting, builds, and instrumentation tests on API 27/36.
• Uploads failure reports and cancel superseded runs.
• Fixes emulator tests by explicitly starting TLS handshakes and refreshing stale network expectations.

[claude]

LGTM — straightforward CI migration with no production code changes.

Extended reasoning...

Overview

This PR replaces Bitrise with a GitHub Actions workflow (.github/workflows/ci.yml) that runs formatting/lint/build and instrumentation tests (API 27 and 36) on push/PR to master, with artifact upload on failure and concurrency-based cancellation of superseded runs. The remaining changes are confined to androidTest files: SSLSocketFactoryTest.java now explicitly calls startHandshake() via a small helper before asserting on the resulting socket (previously relying on getInputStream() to trigger the handshake implicitly), BackgroundReporterTaskTest.java updates one expected HTTP status code for a live network call, and network_security_config.xml updates a pinned SHA-256 hash to match the current live certificate for www.datatheorem.com. No files under trustkit/src/main are touched.

Security risks

None of consequence. The workflow file only affects CI infrastructure (build/lint/test), uses pinned/official actions, and does not handle secrets or elevate permissions beyond contents: read. The test changes touch pinning-related test fixtures and assertions, but not the actual pinning/validation logic in the library itself, so there's no change to TrustKit's runtime security behavior.

Level of scrutiny

Low. This is a CI/test-infrastructure change with no modifications to production/runtime code paths. The refactor to explicitly start the TLS handshake in tests is a reasonable fix for tests that were previously relying on incidental behavior of getInputStream(), and the updated pin/status-code values simply keep tests in sync with the current state of live external endpoints they depend on.

Other factors

The bug-hunting system found no issues. I independently reviewed the diff and confirmed all changes are test-only or CI-config, with no impact to the library's actual certificate pinning logic. The PR content already matches what's present in the current main branch history, consistent with this being a low-risk, already-validated change.

[alexanderdibenedetto]

LGTM!