diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c52bc28
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,28 @@
+name: CI
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install shellcheck
+        run: |
+          scversion="v0.10.0"
+          wget -qO- "https://github.com/koalaman/shellcheck/releases/download/${scversion?}/shellcheck-${scversion?}.linux.x86_64.tar.xz" | tar -xJv
+          echo "${PWD}/shellcheck-${scversion}/shellcheck" >> ${GITHUB_PATH}
+
+      - name: Shellcheck
+        run: |
+          shellcheck ./script/validate/dco ./script/validate/fileheader ./script/validate/vendor
diff --git a/script/validate/dco b/script/validate/dco
index 70fec13..a49b513 100755
--- a/script/validate/dco
+++ b/script/validate/dco
@@ -26,7 +26,7 @@ fi
 verbosity="${DCO_VERBOSITY--v}"
 range=
 commit_range="${DCO_RANGE-}"
-[ ! -z "${commit_range}" ] && {
+[ -n "${commit_range}" ] && {
 	range="-range ${commit_range}"
 }
-GIT_CHECK_EXCLUDE="./vendor:./script/validate/template" git-validation ${verbosity} ${range} -run DCO,short-subject,dangling-whitespace
+GIT_CHECK_EXCLUDE="./vendor:./script/validate/template" git-validation "${verbosity}" "${range}" -run DCO,short-subject,dangling-whitespace
diff --git a/script/validate/vendor b/script/validate/vendor
index b108414..fcc652b 100755
--- a/script/validate/vendor
+++ b/script/validate/vendor
@@ -38,8 +38,8 @@ DIFF_PATH="vendor/ go.mod go.sum"
 # need word splitting here to avoid reading the whole DIFF_PATH as one pathspec
 #
 # shellcheck disable=SC2046
-DIFF=$(git status --porcelain -- $DIFF_PATH)
-DIFF_CONTENT=$(git diff -- $DIFF_PATH)
+DIFF=$(git status --porcelain -- "${DIFF_PATH}")
+DIFF_CONTENT=$(git diff -- "${DIFF_PATH}")
 
 if [ "$DIFF" ]; then
     echo