diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..e0af0b9
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,50 @@
+name: CI
+
+# Runs on every PR, including fork PRs — which means it executes untrusted
+# code. Containment: pull_request-triggered fork runs receive no secrets and
+# a read-only GITHUB_TOKEN, the runner is an ephemeral hosted VM, and the
+# clamps below cap what a malicious PR can do with the run itself.
+#
+# Deliberately NOT using the setup-repo composite: it floats bun-version to
+# `latest` and installs without a lockfile guarantee, which is fine for
+# trusted release builds but not for untrusted PR code.
+on:
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-lint-test:
+    runs-on: ubuntu-latest
+    # Cap compute abuse from a malicious or runaway PR.
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Don't leave the (read-only) token readable by build/test scripts.
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          # Keep in sync with "packageManager" in package.json.
+          bun-version: 1.3.13
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Install dependencies (locked)
+        # Frozen lockfile: a PR cannot shift dependency resolution without
+        # the lockfile change showing up in the reviewed diff.
+        run: bun install --frozen-lockfile
+
+      - run: bun build:ci
+      - run: bun lint
+      - run: bun type-check:ci
+      - run: bun test