diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..f73b626
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Lint & Verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Run skin linter
+        run: python3 scripts/lint-skin.py --all --baseline
+
+      - name: Verify sequence OAuth specs
+        run: python3 scripts/verify-sequence-oauth.py
+
+      - name: Verify draw.io import script
+        run: python3 scripts/verify-drawio-import.py
+
+      - name: Verify generated icon assets
+        run: |
+          python3 scripts/build-icons.py
+          git diff --ignore-space-at-eol --exit-code -- \
+            skills/diagram-design/assets/icons.html \
+            skills/diagram-design/references/primitive-icons.md
diff --git a/README.md b/README.md
index 56d3711..c56e453 100644
--- a/README.md
+++ b/README.md
@@ -346,6 +346,8 @@ If you touch the draw.io import path, `python3 scripts/verify-drawio-import.py`
 it drives the real extractor against `scripts/fixtures/sample-architecture.drawio` in all four
 container formats and checks the references stay in sync.
 
+All pull requests and pushes are automatically validated via GitHub Actions CI (`.github/workflows/ci.yml`).
+
 ### What loads when
 
 At startup, the agent sees only the skill name and description. When a request matches, it loads `SKILL.md`; type references are pulled in only when relevant. This keeps the skill fast even with 36 reference files.