diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..aab7b81
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,111 @@
+name: CI
+
+on:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Go mod tidy
+        run: go mod tidy
+
+      - name: Build all binaries
+        run: |
+          go build ./cmd/push-controller/
+          go build ./cmd/sync-controller/
+          go build ./cmd/resolver-controller/
+
+      - name: Vet
+        run: go vet ./...
+
+  e2e:
+    name: e2e
+    runs-on: ubuntu-latest
+    needs: build
+
+    env:
+      KO_DOCKER_REPO: registry.local:5000/git-k8s
+      GOFLAGS: "-mod=mod"
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Setup KinD
+        id: kind
+        uses: chainguard-dev/actions/setup-kind@main
+        with:
+          k8s-version: 1.33.x
+
+      - name: Setup Knative
+        uses: chainguard-dev/actions/setup-knative@main
+        with:
+          version: "1.15.0"
+
+      - name: Install ko
+        uses: ko-build/setup-ko@v0.9
+
+      - name: Go mod tidy
+        run: go mod tidy
+
+      - name: Install CRDs
+        run: kubectl apply -f config/crds/
+
+      - name: Deploy RBAC
+        run: |
+          kubectl create namespace git-system || true
+          kubectl apply -f config/rbac/
+
+      - name: Deploy controllers with ko
+        run: ko apply -f config/deployments/
+
+      - name: Wait for controllers to be ready
+        run: |
+          for deploy in push-controller sync-controller resolver-controller; do
+            echo "Waiting for ${deploy}..."
+            kubectl rollout status deployment/${deploy} \
+              --namespace=git-system --timeout=120s
+          done
+
+      - name: Verify CRDs are installed
+        run: |
+          kubectl get crd gitrepositories.git.k8s.io
+          kubectl get crd gitbranches.git.k8s.io
+          kubectl get crd gitpushtransactions.git.k8s.io
+          kubectl get crd gitreposyncs.git.k8s.io
+
+      - name: Smoke test - create a GitRepository
+        run: |
+          cat <<EOF | kubectl apply -f -
+          apiVersion: git.k8s.io/v1alpha1
+          kind: GitRepository
+          metadata:
+            name: test-repo
+            namespace: default
+          spec:
+            url: https://github.com/example/test.git
+          EOF
+          kubectl get gitrepositories -A
+
+      - name: Collect diagnostics
+        if: ${{ failure() }}
+        uses: chainguard-dev/actions/kind-diag@main
+        with:
+          artifact-name: kind-logs
+          cluster-resources: nodes,namespaces,crds
+          namespace-resources: pods,deployments,services