diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..8d31567
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,124 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  lint:
+    name: Lint scripts & YAML
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-22.04, ubuntu-20.04]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install linters
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y shellcheck yamllint gettext-base curl ca-certificates
+
+      - name: Shellcheck - scan shell scripts
+        run: |
+          set -e
+          files=$(git ls-files 'awx-local-setup/*.sh' || true)
+          if [ -n "$files" ]; then
+            echo "Running shellcheck on: $files"
+            shellcheck -x $files
+          else
+            echo "No shell scripts found to lint"
+          fi
+
+      - name: Shell syntax check
+        run: |
+          set -e
+          for f in awx-local-setup/*.sh; do
+            [ -f "$f" ] || continue
+            echo "Checking bash syntax: $f"
+            bash -n "$f"
+          done
+
+      - name: YAML lint
+        run: |
+          set -e
+          files=$(git ls-files '*.yml' '*.yaml' || true)
+          if [ -n "$files" ]; then
+            echo "$files" | xargs yamllint -d "extends: default"
+          else
+            echo "No YAML files found to lint"
+          fi
+
+      - name: Dry-run setup script
+        run: |
+          set -e
+          chmod +x awx-local-setup/setup_awx_local.sh
+          ./awx-local-setup/setup_awx_local.sh --dry-run --repo-root="$(pwd)"
+
+  kustomize-validate:
+    name: Validate kustomize builds (if any)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install kustomize and kubectl
+        run: |
+          set -e
+          if ! command -v kustomize >/dev/null 2>&1; then
+            curl -sSL "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash -s 5.0.0
+            sudo mv kustomize /usr/local/bin/kustomize || true
+          fi
+          if ! command -v kubectl >/dev/null 2>&1; then
+            curl -sSL -o kubectl https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl
+            chmod +x kubectl
+            sudo mv kubectl /usr/local/bin/kubectl
+          fi
+
+      - name: Run kustomize build for known directories
+        run: |
+          set -e
+          ok=true
+          for d in config config/*; do
+            if [ -d "$d" ] && ( [ -f "$d/kustomization.yaml" ] || [ -f "$d/kustomization.yml" ] ); then
+              echo "Building kustomize for $d"
+              kustomize build "$d" >/dev/null || { ok=false; echo "kustomize build failed for $d"; }
+            fi
+          done
+          $ok || (echo "One or more kustomize builds failed" && exit 1)
+
+      - name: Kustomize -> kubectl --dry-run=client validation
+        run: |
+          set -e
+          any=false
+          for d in config config/*; do
+            if [ -d "$d" ] && ( [ -f "$d/kustomization.yaml" ] || [ -f "$d/kustomization.yml" ] ); then
+              echo "Validating manifests from $d with kubectl --dry-run=client"
+              kustomize build "$d" | kubectl apply --dry-run=client -f - || { echo "kubectl --dry-run failed for $d"; exit 1; }
+              any=true
+            fi
+          done
+          if [ "$any" = false ]; then
+            echo "No kustomize directories found to validate with kubectl"
+          fi
+
+  release:
+    name: Create release artifact
+    runs-on: ubuntu-latest
+    needs: [lint, kustomize-validate]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Create tarball
+        run: |
+          tar -czf awx-local-setup.tar.gz awx-local-setup
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: awx-local-setup
+          path: awx-local-setup.tar.gz