diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..5f86058
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,53 @@
+name: test
+
+on: [ push, pull_request ]
+
+defaults:
+  run:
+    working-directory: action
+
+jobs:
+  deduplicate:
+    timeout-minutes: 5
+
+    runs-on: ubuntu-latest
+
+    # run on external PRs, but on internal PRs as they'll be run by the push to the branch.
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
+
+    steps:
+      - run: echo ::warning ::skipped duplicate run
+        working-directory: .
+
+  audit:
+    timeout-minutes: 5
+
+    needs: deduplicate
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v2.1.4
+      - run: npm audit --audit-level=critical
+
+  test:
+    timeout-minutes: 5
+
+    needs: audit
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v2.1.4
+        with:
+          node-version: 14
+
+      - uses: actions/cache@v2
+        with:
+          path: ~/.npm
+          key: ${{ hashFiles('**/package-lock.json') }}
+
+      - run: npm ci
+      - run: npm run test:ci