diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c9c8f89
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,72 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Download dependencies
+        run: go mod download
+
+      - name: Run tests
+        run: go test -v -race -coverprofile=coverage.out ./...
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: coverage.out
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          args: --timeout=5m
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build
+        run: go build -v ./...
diff --git a/internal/files/yaml_test.go b/internal/files/yaml_test.go
index 3752ad3..cfdd40f 100644
--- a/internal/files/yaml_test.go
+++ b/internal/files/yaml_test.go
@@ -216,10 +216,10 @@ func TestConvertToYAMLPath(t *testing.T) {
 		{"containers[0].image", "$.containers[0].image", false},
 		{"$.already.prefixed", "$.already.prefixed", false},
 		// Error cases
-		{".image.tag", "", true},           // Leading dot
-		{".version", "", true},             // Leading dot
-		{"..recursive", "", true},          // Double dot
-		{"", "", true},                     // Empty path
+		{".image.tag", "", true},  // Leading dot
+		{".version", "", true},    // Leading dot
+		{"..recursive", "", true}, // Double dot
+		{"", "", true},            // Empty path
 	}
 
 	for _, tt := range tests {
diff --git a/internal/github/client_test.go b/internal/github/client_test.go
index 64d752f..316b61e 100644
--- a/internal/github/client_test.go
+++ b/internal/github/client_test.go
@@ -74,7 +74,7 @@ func TestPRRequest_Validate(t *testing.T) {
 	}{
 		{
 			name:    "valid request",
-			modify:  func(r *PRRequest) {},
+			modify:  func(_ *PRRequest) {},
 			wantErr: "",
 		},
 		{
diff --git a/main.go b/main.go
index 6e9498f..2a23e36 100644
--- a/main.go
+++ b/main.go
@@ -285,7 +285,7 @@ func getModifiedFiles(cfg Config) []string {
 // runHelmDocs executes helm-docs with the provided arguments and returns the list of modified files.
 func runHelmDocs(argsStr string) ([]string, error) {
 	args := strings.Fields(argsStr)
-	cmd := exec.Command("helm-docs", args...)
+	cmd := exec.Command("helm-docs", args...) //nolint:gosec // args are from trusted input
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	if err := cmd.Run(); err != nil {
@@ -304,7 +304,7 @@ func getGitModifiedFiles() ([]string, error) {
 		return nil, fmt.Errorf("running git status: %w", err)
 	}
 
-	var files []string
+	var result []string
 	for _, line := range strings.Split(string(output), "\n") {
 		line = strings.TrimSpace(line)
 		if line == "" {
@@ -315,11 +315,11 @@ func getGitModifiedFiles() ([]string, error) {
 		if len(line) >= 3 {
 			file := strings.TrimSpace(line[2:])
 			if file != "" {
-				files = append(files, file)
+				result = append(result, file)
 			}
 		}
 	}
-	return files, nil
+	return result, nil
 }
 
 func setOutput(name, value string) {