diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..e9d478b
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: latest
+          cache: npm
+      - run: npm ci
+      - run: npm run check
+      - run: npm test
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2dde1ee..e82b499 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -29,6 +29,9 @@ npm run check     # syntax checks, build
 npm pack --dry-run
 ```
 
+CI runs `npm run check` and `npm test` on every pull request and push to `main`, on Linux with
+the latest Node.js (`.github/workflows/ci.yml`).
+
 Tests create a temporary `HOME`, fake credentials and a temporary state directory, so they never
 touch your assistants' settings. One test asserts the published bundle imports nothing but `node:*`,
 which is the point of bundling: `tsdown` inlines `@clack/prompts`, `jsonc-parser` and `smol-toml`