diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 00000000..436dfbe9
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,106 @@
+---
+name: Tests
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  tests:
+    # Distro configuration matrix
+    #
+    # Each build is run in a Docker container specific to the distro.
+    # When adding a new distro, handle the dependency installation in
+    # `ci/gh-install.sh`. The matrix configuration options are:
+    #
+    # name: A friendly name to use for the job.
+    #
+    # image: The Docker image to use.
+    #
+    # pre-checkout-setup: Commands to run before the git repo checkout.
+    #   If git is not in the Docker image, it must be installed here.
+    #   Otherwise, the checkout action uses the GitHub REST API, which
+    #   doesn't result in an actual git repo. A real git repo is
+    #   required to checkout the submodules.
+    #
+    # extra-packages: Packages to install in addition to those in
+    #   `ci/gh-install.sh`. This can be used to support features from
+    #   additional `configure` options.
+    #
+    # configure-options: Options to pass to `configure`.
+    strategy:
+      matrix:
+        include:
+          - name: Debian Buster (10) with sign-ed25519
+            image: debian:buster-slim
+            pre-checkout-setup: |
+              apt-get update
+              apt-get install -y git
+            extra-packages: >-
+              libsodium-dev
+            configure-options: >-
+              --with-ed25519-libsodium
+
+          - name: Debian Buster (10) with curl, sign-ed25519 and no gpgme
+            image: debian:buster-slim
+            pre-checkout-setup: |
+              apt-get update
+              apt-get install -y git
+            extra-packages: >-
+              libsodium-dev
+            configure-options: >-
+              --with-curl
+              --with-ed25519-libsodium
+              --without-gpgme
+
+          # A 32 bit build to act as a proxy for frequently deployed 32
+          # bit armv7
+          - name: Debian Buster (10) 32 bit
+            image: i386/debian:buster-slim
+            # This is pretty nasty. The checkout action uses an x86_64
+            # node binary in the container, so we need to provide an
+            # x86_64 ld.so and libstdc++.
+            pre-checkout-setup: |
+              dpkg --add-architecture amd64
+              apt-get update
+              apt-get install -y git libc6:amd64 libstdc++6:amd64
+
+          - name: Ubuntu Focal (20.04)
+            image: ubuntu:focal
+            pre-checkout-setup: |
+              apt-get update
+              apt-get install -y git
+
+          - name: Ubuntu Groovy (20.10)
+            image: ubuntu:groovy
+            pre-checkout-setup: |
+              apt-get update
+              apt-get install -y git
+
+    name: ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ matrix.image }}
+
+    steps:
+      - name: Pre-checkout setup
+        run: ${{ matrix.pre-checkout-setup }}
+        if: ${{ matrix.pre-checkout-setup }}
+
+      - name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: true
+
+      - name: Install dependencies
+        run: ./ci/gh-install.sh ${{ matrix.extra-packages }}
+
+      - name: Build and test
+        run: ./ci/gh-build.sh ${{ matrix.configure-options }}
+        env:
+          # GitHub hosted runners currently have 2 CPUs, so run 2
+          # parallel make jobs.
+          #
+          # https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners
+          MAKEFLAGS: -j2
diff --git a/ci/gh-build.sh b/ci/gh-build.sh
new file mode 100755
index 00000000..949ce5fa
--- /dev/null
+++ b/ci/gh-build.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+# Copyright © 2015-2016 Collabora Ltd.
+# Copyright © 2021 Endless OS Foundation LLC
+#
+# Permission is hereby granted, free of charge, to any person
+# obtaining a copy of this software and associated documentation files
+# (the "Software"), to deal in the Software without restriction,
+# including without limitation the rights to use, copy, modify, merge,
+# publish, distribute, sublicense, and/or sell copies of the Software,
+# and to permit persons to whom the Software is furnished to do so,
+# subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be
+# included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+set -euo pipefail
+set -x
+
+NOCONFIGURE=1 ./autogen.sh
+
+srcdir="$(pwd)"
+mkdir ci-build
+cd ci-build
+
+make="make V=1 VERBOSE=1"
+
+../configure \
+    --enable-always-build-tests \
+    "$@"
+
+${make}
+
+# Run the tests both using check and distcheck and dump the logs on
+# failures. For distcheck the logs will be inside the dist directory, so
+# tell make to use the current directory.
+if ! ${make} check; then
+    cat test-suite.log || :
+    exit 1
+fi
+if ! ${make} distcheck \
+    TEST_SUITE_LOG=$(pwd)/test-suite.log \
+    DISTCHECK_CONFIGURE_FLAGS="$*"
+then
+    cat test-suite.log || :
+    exit 1
+fi
+
+# Show the installed files
+${make} install DESTDIR=$(pwd)/DESTDIR
+( cd DESTDIR && find . )
+
+# vim:set sw=4 sts=4 et:
diff --git a/ci/gh-install.sh b/ci/gh-install.sh
new file mode 100755
index 00000000..dc0c7fde
--- /dev/null
+++ b/ci/gh-install.sh
@@ -0,0 +1,84 @@
+#!/bin/bash
+
+# Copyright © 2015-2016 Collabora Ltd.
+# Copyright © 2021 Endless OS Foundation LLC
+#
+# Permission is hereby granted, free of charge, to any person
+# obtaining a copy of this software and associated documentation files
+# (the "Software"), to deal in the Software without restriction,
+# including without limitation the rights to use, copy, modify, merge,
+# publish, distribute, sublicense, and/or sell copies of the Software,
+# and to permit persons to whom the Software is furnished to do so,
+# subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be
+# included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+set -euo pipefail
+set -x
+
+NULL=
+
+# Get the OS release info
+. /etc/os-release
+
+case "$ID" in
+    (debian|ubuntu)
+        # Make debconf run non-interactively since its questions can't
+        # be answered.
+        export DEBIAN_FRONTEND=noninteractive
+
+        # TODO: fetch this list from the Debian packaging git repository?
+        apt-get -y update
+        apt-get -y install \
+            attr \
+            bison \
+            cpio \
+            debhelper \
+            dh-autoreconf \
+            dh-systemd \
+            docbook-xml \
+            docbook-xsl \
+            e2fslibs-dev \
+            elfutils \
+            fuse \
+            gjs \
+            gnome-desktop-testing \
+            gobject-introspection \
+            gtk-doc-tools \
+            libarchive-dev \
+            libattr1-dev \
+            libcap-dev \
+            libcurl4-openssl-dev \
+            libfuse-dev \
+            libgirepository1.0-dev \
+            libglib2.0-dev \
+            libgpgme11-dev \
+            liblzma-dev \
+            libmount-dev \
+            libselinux1-dev \
+            libsoup2.4-dev \
+            libsystemd-dev \
+            procps \
+            python3-yaml \
+            systemd \
+            zlib1g-dev \
+            "$@"
+        ;;
+
+    (*)
+        echo "Don't know how to set up ${ID}" >&2
+        exit 1
+        ;;
+esac
+
+# vim:set sw=4 sts=4 et: