diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..76d7442
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,33 @@
+# Every pull request: build, lint and test the shared package.
+name: CI
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      # Two commits deep, so the lint step can compare with the commit before this one.
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+
+      - run: go build ./...
+
+      # New issues only: those on lines changed since the previous commit, which for a pull request is the branch it
+      # merges into. The findings the code already had do not fail the check.
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          args: --new-from-rev=HEAD~
+
+      - run: go test ./...