diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..d2a601a
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,69 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install YAML validator
+        run: python -m pip install --disable-pip-version-check yamllint==1.35.1
+
+      - name: Validate YAML
+        run: |
+          find . -type f \( -name '*.yaml' -o -name '*.yml' \) -print0 | xargs -0 -r yamllint
+
+      - name: Validate JSON
+        run: |
+          found=0
+          while IFS= read -r -d '' file; do
+            found=1
+            jq empty "$file"
+          done < <(find . -type f -name '*.json' -print0)
+          if [ "$found" -eq 0 ]; then
+            echo "No JSON files found; skipping."
+          fi
+
+      - name: Validate TOML
+        run: |
+          found=0
+          while IFS= read -r -d '' file; do
+            found=1
+            python -c 'import pathlib,sys,tomllib; tomllib.loads(pathlib.Path(sys.argv[1]).read_text())' "$file"
+            echo "valid TOML: $file"
+          done < <(find . -type f -name '*.toml' -print0)
+          if [ "$found" -eq 0 ]; then
+            echo "No TOML files found; skipping."
+          fi
+
+  secret-scan:
+    name: Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.23.x"
+
+      - name: Install gitleaks
+        run: go install github.com/zricethezav/gitleaks/v8@v8.21.2
+
+      - name: Run gitleaks
+        run: gitleaks detect --source . --verbose --redact
diff --git a/.yamllint b/.yamllint
new file mode 100644
index 0000000..e0b11c7
--- /dev/null
+++ b/.yamllint
@@ -0,0 +1,7 @@
+extends: default
+
+rules:
+  document-start: disable
+  line-length:
+    max: 120
+  truthy: disable