diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..32590f2
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,18 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  check:
+    name: release integrity
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: bash scripts/test.sh
diff --git a/scripts/test.sh b/scripts/test.sh
new file mode 100755
index 0000000..43d6cb1
--- /dev/null
+++ b/scripts/test.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Release-integrity check for this thin publish repo. The plugin is built in the
+# private tile monorepo; this repo only ships the artifacts (main.js, manifest,
+# styles, versions), so there is nothing to compile here. This mirrors CI:
+# validate manifest/versions consistency and that the bundled main.js parses.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+node -e '
+  const fs = require("fs");
+  const req = ["id","name","version","minAppVersion","description","author","isDesktopOnly"];
+  const m = JSON.parse(fs.readFileSync("manifest.json","utf8"));
+  for (const k of req) if (!(k in m)) throw new Error(`manifest.json missing "${k}"`);
+  const v = JSON.parse(fs.readFileSync("versions.json","utf8"));
+  if (!(m.version in v)) throw new Error(`manifest version ${m.version} is not listed in versions.json`);
+  if (v[m.version] !== m.minAppVersion) throw new Error(`versions.json[${m.version}]=${v[m.version]} != manifest.minAppVersion=${m.minAppVersion}`);
+  console.log(`manifest/versions OK — ${m.id} ${m.version} (minAppVersion ${m.minAppVersion})`);
+'
+node --check main.js
+echo "main.js parses OK"