diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
new file mode 100644
index 00000000..b097315f
--- /dev/null
+++ b/.github/workflows/main.yml
@@ -0,0 +1,37 @@
+# © 2019-2023 Serokell <hi@serokell.io>
+# © 2019-2023 Lars Jellema <lars.jellema@gmail.com>
+#
+# SPDX-License-Identifier: MPL-2.0
+
+name: CI
+on:
+  pull_request:
+  push: #[master]
+
+env:
+  CDN_DISTRIBUTION_ID: E13UN1J1JFIWUZ
+  CDN_BUCKET: s3://nixfmt.serokell.io
+
+jobs:
+  check:
+    runs-on: [self-hosted, nix]
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: reuse lint
+        run: nix shell .#packages.x86_64-linux.reuse -c reuse lint
+
+      - name: build
+        run: nix build .#nixfmt-static
+
+  deploy:
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: deploy webdemo
+        run: |
+          nix build .#nixfmt-webdemo
+          nix shell .#awscli -c aws s3 cp --recursive result/ "$CDN_BUCKET"
+          # delete files that don't exist anymore, use `--size-only` so behavior won't depend on local file timestamps
+          nix shell .#awscli -c aws s3 sync --delete --size-only result/ "$CDN_BUCKET"
+          nix shell .#awscli -c aws cloudfront create-invalidation --distribution-id "$CDN_DISTRIBUTION_ID" --paths '/*'