diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2b8f247
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,24 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    cooldown:
+      default-days: 7
+    directories:
+      - "/"
+    schedule:
+      interval: weekly
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+  - package-ecosystem: github-actions
+    cooldown:
+      default-days: 7
+    directories:
+      - "/"
+    schedule:
+      interval: weekly
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..292f66d
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,34 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    env:
+      # git pathspecs for the Python manifests to resolve, and pathspecs to skip
+      MANIFESTS: "*requirements*.txt *pyproject.toml"
+      EXCLUDE: ""
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+      - name: Syntax check
+        run: uv run --no-project --python 3.12 python -m compileall -q -x '/(\.venv|node_modules)/' .
+      - name: Resolve pinned dependencies
+        run: |
+          set -f
+          read -ra include <<< "$MANIFESTS"
+          read -ra skip <<< "$EXCLUDE"
+          git ls-files -- "${include[@]}" "${skip[@]/#/:!}" | while read -r f; do
+            echo "::group::$f"
+            (cd "$(dirname "$f")" && uv pip compile "$(basename "$f")" \
+              --python-version 3.12 --python-platform x86_64-manylinux_2_28 \
+              -q -o "$RUNNER_TEMP/resolved.txt") || { echo "::error file=$f::dependencies do not resolve"; exit 1; }
+            echo "::endgroup::"
+          done