diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..5593055
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,30 @@
+name: ci
+
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: install rust
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y --default-toolchain stable --profile minimal \
+                --component rustfmt --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ hashFiles('Cargo.lock') }}
+
+      - name: check
+        run: ./check.sh
diff --git a/check.sh b/check.sh
new file mode 100755
index 0000000..18cf180
--- /dev/null
+++ b/check.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+# Everything that has to pass before a commit leaves the machine.
+#
+# The same script runs locally and in CI, so there is one gate and not two
+# that drift apart.
+set -eu
+
+cd "$(dirname "$0")"
+
+say() { printf '\n== %s\n' "$1"; }
+
+say "formatting"
+cargo fmt --check
+
+say "lints"
+cargo clippy --workspace --all-targets --all-features -- -D warnings
+
+say "tests"
+cargo test --workspace
+
+say "docs"
+RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --quiet
+
+# Differential tests against the Python these tools were ported from. Skipped
+# unless an interpreter with the dependencies is named, since most machines do
+# not have one.
+if [ -n "${CATENA_PARITY_PYTHON:-}" ]; then
+	say "parity against python"
+	cargo test -p parity --features python
+else
+	say "parity against python (skipped: set CATENA_PARITY_PYTHON to run it)"
+fi
+
+printf '\nall clear\n'