diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..072aea5
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,64 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  validate:
+    name: Validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Validate applications.json
+        run: make validate
+
+  test:
+    name: Live Test
+    runs-on: ubuntu-latest
+    needs: validate
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Test app configs resolve to APKs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: make test
+
+  check-generated:
+    name: Check Generated Files
+    runs-on: ubuntu-latest
+    needs: validate
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Run make release
+        run: make release
+
+      - name: Check for uncommitted changes
+        run: |
+          if [ -n "$(git diff --name-only)" ]; then
+            echo "Generated files are out of date. Run 'make release' and commit the results."
+            echo ""
+            echo "Changed files:"
+            git diff --name-only
+            echo ""
+            git diff --stat
+            exit 1
+          fi
+          echo "All generated files are up to date."
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 74c8749..6258ef1 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -122,6 +122,16 @@ make test              # verify your app config resolves to a real APK
 make release           # normalize, regenerate README, build release JSONs
 ```
 
+## CI
+
+Pull requests and pushes to `main` are checked by GitHub Actions:
+
+1. **Validate** - runs `make validate` (structural checks, regex syntax, source types)
+2. **Live Test** - runs `make test` (verifies all app configs resolve to real APKs)
+3. **Check Generated Files** - runs `make release` and fails if generated files are out of date
+
+All three must pass before merging.
+
 ## Pre-Commit Checklist
 
 Before committing, run `make test` and `make release`, then verify: