diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..04a4469
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,67 @@
+name: CI
+
+on:
+  pull_request:
+    paths:
+      - "**.go"
+      - "go.mod"
+      - "go.sum"
+      - ".github/workflows/**"
+
+  push:
+    branches:
+      - main
+    paths:
+      - "**.go"
+      - "go.mod"
+      - "go.sum"
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  ci:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read # for code checkout
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v 6.4.0
+        with:
+          go-version-file: go.mod
+          cache: true
+      
+       # Cache build artifacts in addition to module cache
+      - name: Cache Go build
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-build-
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        with:
+          version: v2.12
+        
+      - name: Run vulnerability scan
+        uses: golang/govulncheck-action@31f7c5463448f83528bd771c2d978d940080c9fd # unknown tag
+        with:
+          go-package: ./...
+      
+      - name: Run unit tests
+        run: make unit
+      
+      - name: Build
+        run: make build
+      
+      # - name: Run FTs
+      #   run: make functional
diff --git a/.golangci.yaml b/.golangci.yaml
new file mode 100644
index 0000000..c4b3a6e
--- /dev/null
+++ b/.golangci.yaml
@@ -0,0 +1,9 @@
+version: "2"
+
+linters:
+  exclusions:
+    paths-except:
+      # Don't want to lint vendored code.
+      - "vendor/"
+      # There will be linting issues on purpose.
+      - "test/"
diff --git a/Makefile b/Makefile
index 20698b9..0be1575 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,18 @@ CMD_DIR := ./cmd
 DIST_DIR := ./dist
 BINARY_NAME := dblinter
 
+GOLANGCI_LINT := golangci-lint
+GOLANGCI_VERSION := v2.12.2 # TODO: make this aligned with CI.
+
+## tools: installs necessary tools to run quality check
+tools:
+	@if ! command -v $(GOLANGCI_LINT) >/dev/null 2>&1; then \
+		echo "Installing $(GOLANGCI_LINT)..."; \
+		curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $$(go env GOPATH)/bin $(GOLANGCI_VERSION); \
+	else \
+		echo "$(GOLANGCI_LINT) already installed"; \
+	fi
+
 ## build: build dblinter
 build:
 	go build -o $(DIST_DIR)/$(BINARY_NAME) $(CMD_DIR)/$(BINARY_NAME)
@@ -11,5 +23,15 @@ run: build
 	$(DIST_DIR)/$(BINARY_NAME) ./tests/...
 
 ## unit: run unit tests
-unit:
+unit: mocks
 	go test ./... -timeout 30s
+
+lint: tools
+	golangci-lint run --config .golangci.yaml
+
+## mocks: generate mocks
+mocks:
+	mockery --config .mockery.yml
+
+functional:
+	 $(DIST_DIR)/$(BINARY_NAME) ./tests/...