diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..55bb012
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,23 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: |
+            6.0.x
+            8.0.x
+      - name: Build
+        run: dotnet build DiscreteParser.csproj -c Release
+      # The test project arrives with the first fix PR; until then there is nothing to run.
+      - name: Test
+        if: hashFiles('tests/SPADE.Tests/SPADE.Tests.csproj') != ''
+        run: dotnet test tests/SPADE.Tests/SPADE.Tests.csproj -c Release
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..aa42087
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,40 @@
+name: Publish to NuGet
+
+# Push a tag v<Version> (matching <Version> in DiscreteParser.csproj) to build, test and publish that version.
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # lets NuGet/login trade a GitHub OIDC token for a short-lived nuget.org key
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: |
+            6.0.x
+            8.0.x
+      - name: Check the tag matches the project version
+        run: |
+          version=$(grep -oP '(?<=<Version>)[^<]+' DiscreteParser.csproj)
+          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match <Version>$version</Version> in DiscreteParser.csproj"
+            exit 1
+          fi
+      - name: Test
+        if: hashFiles('tests/SPADE.Tests/SPADE.Tests.csproj') != ''
+        run: dotnet test tests/SPADE.Tests/SPADE.Tests.csproj -c Release
+      - name: Pack
+        run: dotnet pack DiscreteParser.csproj -c Release -o out
+      # Trusted publishing: the nuget.org policy (owner Trosper3) must name ReduxISU/SPADE and publish.yml.
+      - name: NuGet login
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: Trosper3
+      - name: Push
+        run: dotnet nuget push "out/*.nupkg" --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate