diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml
new file mode 100644
index 0000000..5333267
--- /dev/null
+++ b/.github/actions/build/action.yml
@@ -0,0 +1,42 @@
+name: Build
+description: >
+  The static site, into ./dist.
+
+  A composite action rather than a reusable workflow so it runs in the caller's
+  job, under the caller's name -- CI / Build -- rather than as a nested
+  "caller / callee" check.
+
+  It has exactly one caller: there is no CD here, so nothing can drift from
+  anything. It is split out so this repository has the same shape as the rest of
+  the organisation, and for no stronger reason than that.
+
+  NOTHING LEAVES THE RUNNER. The site is left in ./dist for ../test to assert
+  against.
+
+runs:
+  using: composite
+  steps:
+    # pnpm, not bun. The other four -web repos in this organisation are bun with
+    # the version pinned in .mise.toml; this one has a pnpm-lock.yaml and no
+    # .mise.toml at all. Installing what the committed lockfile describes is the
+    # right thing for a pull request that is only meant to add a check --
+    # converting the lockfile is a separate change with its own risk.
+    - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      with:
+        version: 9
+
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      with:
+        node-version: 22
+        cache: pnpm
+
+    # --frozen-lockfile so CI fails on a lockfile that does not match
+    # package.json, rather than quietly resolving something newer than what
+    # anyone has run locally.
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile
+
+    - name: Build
+      shell: bash
+      run: pnpm run build
diff --git a/.github/actions/test/action.yml b/.github/actions/test/action.yml
new file mode 100644
index 0000000..7067371
--- /dev/null
+++ b/.github/actions/test/action.yml
@@ -0,0 +1,21 @@
+name: Test
+description: >
+  Is this commit good. Nothing is published here; a failure means the site is
+  wrong, not that the pipeline is.
+
+  Runs AFTER ../build, because everything it asserts is a property of ./dist. A
+  static site has two ways to be broken that matter -- it did not build, and it
+  built the wrong thing -- and only the second one needs a test.
+
+  NO no-JavaScript assertion, unlike the static sites in the nicodes
+  organisation. This one ships Qwik, so it emits JavaScript on purpose and that
+  check would fail on its first run.
+
+runs:
+  using: composite
+  steps:
+    # A build that emits nothing still "succeeds", so the artefact is checked
+    # rather than the exit code.
+    - name: The page was actually written
+      shell: bash
+      run: test -s dist/index.html
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..a9a2d08
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,39 @@
+name: CI
+
+# Every pull request and every merge to main: build, then test, on one runner.
+#
+# This repository had NO .github at all, while its three sibling -web repos --
+# gdam-web, gdlint-web, termcade-web -- all had CI. Nothing has ever checked it.
+#
+# The push trigger is not redundant: there is no CD here, so nothing else covers
+# a merge to main.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    # Bounded, so a step that hangs fails here rather than sitting until the
+    # runner's own timeout hours later.
+    timeout-minutes: 15
+    steps:
+      # Third-party actions are pinned by SHA, with the tag in a trailing
+      # comment so the version is still readable.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Build
+        uses: ./.github/actions/build
+
+      - name: Test
+        uses: ./.github/actions/test