diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..98fb567
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,75 @@
+---
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
+
+      - name: Install Biome
+        run: |
+          npm install -g @biomejs/biome@2.3.2
+
+      - name: Install just
+        run: |
+          JUST_VERSION="1.46.0"
+          JUST_BASE="https://github.com/casey/just/releases/download"
+          JUST_TAR="just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+          curl -fsSL "${JUST_BASE}/${JUST_VERSION}/${JUST_TAR}" | tar xz -C /tmp
+          sudo mv /tmp/just /usr/local/bin/
+
+      - name: Install rumdl
+        run: |
+          RUMDL_VERSION="v0.1.26"
+          RUMDL_BASE="https://github.com/rvben/rumdl/releases/download"
+          RUMDL_TAR="rumdl-${RUMDL_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
+          curl -fsSL "${RUMDL_BASE}/${RUMDL_VERSION}/${RUMDL_TAR}" | tar xz
+          sudo mv rumdl /usr/local/bin/
+
+      - name: Install linting tools
+        run: |
+          uv tool install yamllint
+          uv tool install codespell
+
+      - name: Cache Vale styles
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: .vale
+          key: vale-styles-${{ hashFiles('.vale.ini') }}
+          restore-keys: |
+            vale-styles-
+
+      - name: Install and sync Vale
+        run: |
+          uv tool install vale
+          vale sync
+
+      - name: Run linters
+        run: just lint
+
+      - name: Lint GitHub Actions workflows
+        run: |
+          bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+          ./actionlint -color