diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..226ab16
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,54 @@
+# The test suite runs under Sage's Python only, so CI runs inside the
+# official Sage container rather than installing Sage on the runner.  The
+# container is a minimal image (no bash, no make), so the steps below spell
+# out the commands the Makefile targets run.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Sage test suite
+    runs-on: ubuntu-latest
+    container:
+      image: sagemath/sagemath:latest
+      options: --user root
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Environment probe
+        run: |
+          cat /etc/os-release | head -2
+          sage --version
+          for t in sh bash make apt-get git tee grep; do
+            printf '%s: %s\n' "$t" "$(command -v $t || echo MISSING)"
+          done
+
+      - name: Install test dependencies
+        run: sage -pip install --no-input pyyaml pytest
+
+      - name: Unit tests            # make test
+        run: sage -python -m pytest tests -q
+
+      - name: Doctests              # make doctest
+        run: PYTHONPATH="$PWD" sage -t diophantine_classifier/
+
+      - name: Docstring coverage    # make coverage; must stay 100%
+        run: |
+          sage --coverage diophantine_classifier/ | tee coverage.txt
+          if grep '^SCORE' coverage.txt | grep -v ': 100.0%'; then
+            echo "::error::docstring coverage regressed"
+            exit 1
+          fi
+
+      - name: Bibliography and registry validation      # make references
+        if: ${{ hashFiles('tools/check_references.py') != '' }}
+        run: sage -python tools/check_references.py --quiet