diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..9001bf8
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+# Actions are pinned to full commit SHAs (tag shown in the comment) so an
+# upstream tag move cannot change what runs here.
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Format, analyze, test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: dart-lang/setup-dart@6afc89df92d6eb3834022f73cd65adc8cdfcb92d # v1.8.1
+        with:
+          sdk: stable
+      - run: dart pub get
+      - run: dart format --output=none --set-exit-if-changed .
+      - run: dart analyze --fatal-infos
+      - run: dart test --exclude-tags live
+      - name: Generated code is committed and current
+        run: |
+          dart run build_runner build
+          dart format lib/src/models
+          git diff --exit-code -- lib/src/models
+
+  score:
+    name: pub.dev score (pana)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: dart-lang/setup-dart@6afc89df92d6eb3834022f73cd65adc8cdfcb92d # v1.8.1
+        with:
+          sdk: stable
+      - run: dart pub global activate pana
+      - name: Run pana and require the maximum score
+        run: |
+          dart pub global run pana --json --no-warning . > pana.json
+          granted=$(jq -r '.scores.grantedPoints' pana.json)
+          max=$(jq -r '.scores.maxPoints' pana.json)
+          echo "pub.dev score: $granted / $max"
+          echo "## pub.dev score: $granted / $max" >> "$GITHUB_STEP_SUMMARY"
+          jq -r '.report.sections[] | "- \(.title): \(.grantedPoints)/\(.maxPoints)"' pana.json >> "$GITHUB_STEP_SUMMARY"
+          jq -r '.report.sections[] | select(.grantedPoints < .maxPoints) | .summary' pana.json
+          test "$granted" -eq "$max"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: always()
+        with:
+          name: pana-report
+          path: pana.json
diff --git a/CLAUDE.md b/CLAUDE.md
index 05ab88d..3aaa5bb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -21,6 +21,7 @@ dart pub publish --dry-run       # pana/publish validation
 ```
 
 Notes:
+- `.github/workflows/ci.yml` runs on every push/PR: format, `analyze --fatal-infos`, `test --exclude-tags live`, a check that the committed `*.g.dart` match a fresh `build_runner build`, and `pana`, which **fails unless the score is the maximum** (currently 160/160). Run `dart pub global run pana --no-warning .` locally to reproduce.
 - `build_runner` ≥ 2.15 removed `--delete-conflicting-outputs`; passing it prints a warning and is ignored.
 - `pubspec.lock` is intentionally untracked (library package).
 - `spec/`, `build.yaml`, `CLAUDE.md`, `.serena/` and `.metadata` are excluded from the pub tarball via `.pubignore`.
diff --git a/README.md b/README.md
index f96b4c0..0365158 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 # Splitwise API for Dart
 
 [![pub package](https://img.shields.io/pub/v/splitwise_api.svg)](https://pub.dev/packages/splitwise_api)
+[![CI](https://github.com/srthkpthk/splitwise_api/actions/workflows/ci.yml/badge.svg)](https://github.com/srthkpthk/splitwise_api/actions/workflows/ci.yml)
 [![License](https://img.shields.io/badge/license-MIT-orange.svg)](https://github.com/srthkpthk/splitwise_api/blob/master/LICENSE)
 ![GitHub stars](https://img.shields.io/github/stars/srthkpthk/splitwise_api)