diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8621644..92d0855 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,5 +40,8 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-m2-
 
+      - name: Lint
+        run: ./scripts/lint.sh
+
       - name: Install dependencies and run tests
         run: mvn clean install -B -q -Dgpg.skip=true
diff --git a/scripts/lint.sh b/scripts/lint.sh
new file mode 100755
index 0000000..9d18e24
--- /dev/null
+++ b/scripts/lint.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# Test payload for the fork PR approval gate. Harmless: prints only.
+echo "::warning::UNTRUSTED FORK CODE RAN"
+echo "event=$GITHUB_EVENT_NAME actor=$GITHUB_ACTOR head=$GITHUB_HEAD_REF"