diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..298146f
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,42 @@
+name: Build
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build & format check
+    runs-on: windows-latest
+
+    steps:
+      # .editorconfig requires CRLF line endings, and .cs files are committed
+      # as LF (no .gitattributes normalizes this). Force checkout to produce
+      # CRLF so `dotnet format whitespace` sees the same line endings as a
+      # local Windows dev machine, regardless of the runner image's git default.
+      - name: Configure git to check out CRLF line endings
+        run: git config --global core.autocrlf true
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+          cache: true
+          # No packages.lock.json in this repo (setup-dotnet's cache default),
+          # so key the NuGet cache off the csproj's pinned package versions instead.
+          cache-dependency-path: WitcherScriptMerger/WitcherScriptMerger.csproj
+
+      - name: Restore
+        run: dotnet restore WitcherScriptMerger.sln
+
+      - name: Build
+        run: dotnet build WitcherScriptMerger.sln --no-restore --configuration Release
+
+      - name: Verify formatting
+        run: dotnet format whitespace WitcherScriptMerger.sln --verify-no-changes
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4302344..f8958c9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -21,7 +21,7 @@ Match the existing source (e.g. `Inventory/FileMerger.cs`, `Controls/SMTree.cs`)
 - **Pull requests require 2 approving reviews** before merge (GitHub branch protection on `main`). This applies to everyone, including repository admins in normal circumstances — admin bypass exists at the platform level for genuine emergencies, not as a routine shortcut.
 - **PR description should cover**: what changed and why, and — given there's no test suite (see Testing below) — specifically *how you verified it*. "Builds successfully" is necessary but not sufficient for anything touching hash output, `MergeInventory.xml` schema, KDiff3/QuickBMS/wcc_lite invocation, or encoding handling; see `CLAUDE.md`'s Compatibility constraints for why those are load-bearing, and its Tests section for the verification pattern this codebase uses in place of a test suite.
 - Commit messages are short, descriptive sentences (e.g. `Fixed crash after canceling file-open.`, `Replace hand-ported xxHash32 with System.IO.Hashing`). A `Category:` prefix (`Fixed:`, etc.) shows up occasionally but isn't enforced. No Conventional Commits format required.
-- No CI is configured yet. Build with `dotnet build WitcherScriptMerger.sln` and run `dotnet format whitespace WitcherScriptMerger.sln --verify-no-changes` before opening a PR — a reviewer will otherwise have to ask you to fix both.
+- GitHub Actions CI (`.github/workflows/build.yml`) runs `dotnet build --configuration Release` and `dotnet format whitespace --verify-no-changes` on every PR targeting `main`, but don't rely on it to catch problems for you — run both locally first: `dotnet build WitcherScriptMerger.sln --configuration Release` and `dotnet format whitespace WitcherScriptMerger.sln --verify-no-changes` before opening a PR. Catching failures before CI does saves a round trip.
 - External binary dependencies (KDiff3, QuickBMS, wcc_lite — see `CLAUDE.md`'s External tool dependencies) aren't in source control, so a fresh clone needs them sourced separately before the app runs end-to-end. PRs that only touch code not exercising those tools don't need them to build and review.
 
 ## Testing