diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..f328dcd
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,43 @@
+name: Test
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        # The floor and the newest. 3.10 is the real floor: main.py annotates
+        # with `str | None` and has no `from __future__ import annotations`, so
+        # the annotation is evaluated at def time, and main_test.py uses
+        # parenthesized context managers. Both are 3.10+.
+        #
+        # The action itself runs on whatever python3 the runner ships, so the
+        # in-between versions add little here — unlike commit-check, which is a
+        # published package and tests every one.
+        py: ['3.10', '3.14']
+        os: ['ubuntu-latest', 'macos-latest', 'windows-latest']
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.py }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          # requirements.txt rather than a bare install: it pins the same
+          # commit-check the action ships, which is the version the golden
+          # tests expect to read back out of importlib.metadata.
+          python -m pip install -r requirements.txt pytest
+
+      - name: Run unit tests
+        run: python -m pytest main_test.py -v