diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..86795c7
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,40 @@
+name: tests
+
+on:
+  push:
+    branches: ["master", "phase*/**", "srix"]
+  pull_request:
+
+jobs:
+  pytest:
+    name: pytest (py${{ matrix.python }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.10", "3.12"]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+      - run: python -m pip install -r requirements.txt
+      - run: python -m pytest -q
+
+  codegen-drift:
+    # The generated parsers under pytamil/தமிழ்/codegen are committed. Regenerate them
+    # from the grammars and fail if anything differs, so grammar and codegen cannot drift.
+    name: codegen matches grammars
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "21"
+      - run: bash codegen.sh
+      - name: fail on drift
+        run: |
+          git status --porcelain -- pytamil/தமிழ்/codegen
+          git diff --exit-code --stat -- pytamil/தமிழ்/codegen
diff --git a/requirements.txt b/requirements.txt
index 5dd6522..cfc869a 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -10,7 +10,7 @@ Open-Tamil==1.1
 packaging==23.1
 pluggy==1.0.0
 pytest==7.3.1
-PyYAML==6.0
+PyYAML==6.0.2               # 6.0 does not build on Python 3.12+
 regex==2023.5.5
 TatSu==5.8.3
 tomli==2.0.1