diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c8890e8
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,30 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# No secrets, no untrusted input (no github.event.* interpolation): static commands only.
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Versions (jq + shellcheck are preinstalled on ubuntu-latest)
+        run: |
+          jq --version
+          shellcheck --version | sed -n '1,2p'
+
+      - name: Make scripts executable
+        run: chmod +x bin/*.sh bin/modelfit bin/lib/*.sh tests/curl
+
+      - name: selftest (zero API spend, runs against the mock provider)
+        run: ./bin/selftest.sh
+
+      - name: shellcheck (catches word-splitting / SC2086 etc.)
+        run: shellcheck bin/run.sh bin/judge.sh bin/report.sh bin/doctor.sh bin/selftest.sh bin/scan-secrets.sh bin/modelfit bin/lib/common.sh tests/curl tests/reliability.test.sh
diff --git a/README.md b/README.md
index 296eaeb..5b42a8b 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # ModelFit
 
+[![CI](https://github.com/kwadwoadu/modelfit/actions/workflows/ci.yml/badge.svg)](https://github.com/kwadwoadu/modelfit/actions/workflows/ci.yml)
+
 **Find the best LLM for your codebase—not someone else’s benchmark.**
 
 ![ModelFit running a probe across candidate models, blind-judging, and ranking them](assets/demo.gif)