diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..9dde228
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,34 @@
+name: CI
+
+# Runs on every PR (incl. external forks — read-only token, no secrets) and on
+# pushes to main. This is the check the "Protect" ruleset requires before merge,
+# so external contributions can't land on main with failing types/lint/tests.
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.11
+      - run: bun install --frozen-lockfile
+      # git-core's initRepository tests make real commits, which need an identity;
+      # a fresh runner has none (developer machines do, via global git config).
+      - name: Configure git identity for tests
+        run: |
+          git config --global user.email "ci@clawnify.dev"
+          git config --global user.name "Ateam CI"
+      - run: bun run typecheck
+      # `lint` (biome) is intentionally omitted: biome's native binary doesn't
+      # resolve cleanly yet. Add `bun run lint` here once that's fixed.
+      - run: bun test
diff --git a/package.json b/package.json
index 5d1c4cd..2b5fe97 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   ],
   "scripts": {
     "test": "bun test",
-    "typecheck": "tsc -b --pretty",
+    "typecheck": "bash scripts/typecheck.sh",
     "lint": "biome check .",
     "format": "biome format --write ."
   },
diff --git a/scripts/typecheck.sh b/scripts/typecheck.sh
new file mode 100755
index 0000000..01467c3
--- /dev/null
+++ b/scripts/typecheck.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Typecheck every workspace project. Each package/app tsconfig is a standalone
+# `noEmit` config — the repo has no composite build graph, so `tsc -b` doesn't
+# apply. Check them one by one; run all before exiting so contributors see every
+# project's errors at once, not just the first that fails.
+set -uo pipefail
+cd "$(dirname "$0")/.."
+
+configs=(
+  apps/desktop/tsconfig.node.json
+  apps/desktop/tsconfig.web.json
+  packages/*/tsconfig.json
+)
+
+status=0
+for cfg in "${configs[@]}"; do
+  echo "▸ tsc -p $cfg"
+  ./node_modules/.bin/tsc --noEmit -p "$cfg" || status=1
+done
+exit "$status"