diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..aa11922
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,68 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  # Main-branch runs validate merge results the PR runs never see, so only
+  # superseded pull-request runs may be cancelled.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  bun:
+    name: Bun
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun ci
+
+      - name: Typecheck
+        run: bun run typecheck
+
+      - name: Test
+        run: bun test
+
+      - name: Build
+        run: bun run build
+
+  pnpm:
+    name: pnpm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      # The test script runs `bun test`, so Bun is required in this job too.
+      - name: Install Bun
+        uses: oven-sh/setup-bun@v2
+
+      # PluginDatabase installs with pnpm, so this job mirrors that path.
+      # Version 10 is pinned because it natively writes lockfileVersion 9.0.
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck
+        run: pnpm run typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: pnpm run build
diff --git a/tests/release.test.ts b/tests/release.test.ts
index 071b3e2..4214ece 100644
--- a/tests/release.test.ts
+++ b/tests/release.test.ts
@@ -1,7 +1,8 @@
 import { afterEach, describe, expect, test } from 'bun:test';
 import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 import { createReleaseArchive, readReleaseVersion, RELEASE_FILES, verifyReleaseArchive } from '../scripts/release';
 
@@ -42,3 +43,10 @@ describe('release packaging', () => {
 		);
 	});
 });
+
+describe('checked-in manifests', () => {
+	test('keep package.json and plugin.json synchronized', async () => {
+		const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+		await expect(readReleaseVersion(repositoryRoot)).resolves.toBeDefined();
+	});
+});