diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000000..b8270841e8c
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,29 @@
+name: CI
+on: [push, pull_request]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    container: ubuntu:focal
+    steps:
+      - name: Install Git
+        run: |
+          apt-get update && apt-get install --yes git
+          virtualenv .venv
+          # TODO: this should be one step, but there are too many conflicting dependencies
+          ./venv/bin/pip install -r securedrop/requirements/python3/develop-requirements.txt
+          ./venv/bin/pip install -r securedrop/requirements/python3/test-requirements.txt
+
+      - uses: actions/checkout@v3
+      - name: Install dependencies
+        run: |
+          apt-get install --yes --no-install-recommends \
+            build-essential python3-virtualenv python3-dev enchant file
+          virtualenv .venv
+          # TODO: this should be one step, but there are too many conflicting dependencies
+          ./.venv/bin/pip install -r securedrop/requirements/python3/develop-requirements.txt
+          ./.venv/bin/pip install -r securedrop/requirements/python3/test-requirements.txt
+      - name: Run lint
+        run: |
+          source .venv/bin/activate
+          make lint