diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..a8fc7b3
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Shell and plugin checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Syntax check (bash -n)
+        run: find . -name '*.sh' -not -path './.git/*' -print0 | xargs -0 -n1 bash -n
+
+      - name: Lint (shellcheck)
+        run: find . -name '*.sh' -not -path './.git/*' -print0 | xargs -0 shellcheck --severity=warning
+
+      - name: Validate plugin manifest
+        run: |
+          jq empty .claude-plugin/plugin.json
+          test -d skills
+          test -d commands
+
+      - name: Smoke-run verify gate (must exit 0)
+        run: bash scripts/verify-dev.sh .
diff --git a/README.md b/README.md
index e211094..18e99d7 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@ A Claude Code plugin that runs the whole development loop from one command —
 investigate → plan → TDD → verify → ship — and backs each quality gate with a
 deterministic host-side hook, not a prompt reminder the model can forget.
 
+[![CI](https://github.com/zelinewang/dev-orchestrator/actions/workflows/ci.yml/badge.svg)](https://github.com/zelinewang/dev-orchestrator/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Claude Code plugin](https://img.shields.io/badge/Claude%20Code-plugin-8A2BE2.svg)](https://docs.claude.com/en/docs/claude-code/overview)
 [![Shell](https://img.shields.io/github/languages/top/zelinewang/dev-orchestrator.svg)](https://github.com/zelinewang/dev-orchestrator)