diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000000..2faae04871f
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,30 @@
+name: CI
+on: [push, pull_request]
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    container: ubuntu:focal
+    steps:
+      - name: Install Git
+        run: |
+          apt-get update && apt-get install --yes git
+      - uses: actions/checkout@v3
+      - name: Install dependencies
+        run: |
+          DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC apt-get install --yes --no-install-recommends \
+            build-essential python3-virtualenv python3-dev enchant file apache2-dev
+          virtualenv .venv
+          # TODO: this should be one step, but there are too many conflicting dependencies
+          ./.venv/bin/pip install -r securedrop/requirements/python3/test-requirements.txt
+          ./.venv/bin/pip install -r securedrop/requirements/python3/requirements.txt
+          ./.venv/bin/pip install -r securedrop/requirements/python3/develop-requirements.txt
+      - name: Run lint
+        run: |
+          git config --global --add safe.directory $GITHUB_WORKSPACE
+          source .venv/bin/activate
+          make lint