diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..97e809e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,87 @@
+name: CI
+
+on:
+  push:
+    branches: [ "master", "prod" ]
+  pull_request:
+    branches: [ "master" ]
+
+env:
+  node-version: 4.5.0
+
+jobs:
+
+  tests:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - uses: actions/setup-node@v3
+      with:
+        node-version: ${{ env.node-version }}
+
+    - name: Build
+      run: |
+        set -eux
+        npm install -g grunt-cli@1.3.2 bower@^1.8.12 protractor@^7.0.0
+        npm install
+        bower install
+
+    - name: Tests
+      run: |
+        set -eux
+        # Tests are disabled, used to be:
+        # grunt test-e2e
+        # grunt test
+      env:
+        DEV_FAKE_AUTH: true
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: tests
+
+    if: ${{ github.ref == 'ref/head/prod' || github.ref == 'ref/head/master' }}
+
+    # Fake ternary, see https://github.com/actions/runner/issues/409#issuecomment-752775072
+    environment: ${{ ( github.ref == 'ref/head/prod' && 'prod' ) || 'test' }}
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - uses: actions/setup-node@v3
+      with:
+        node-version: ${{ env.node-version }}
+
+    - name: Install dependencies
+      run: |
+        set -eux
+        pipx install awscli
+        npm install -g grunt-cli@1.3.2 bower@^1.8.12
+        npm install
+        bower install
+
+    - name: Patch code
+      run: |
+        set -eux
+        sed -i "s#FRONT_DOMAIN.*#FRONT_DOMAIN: '${{ vars.DEPLOY_FRONT_DOMAIN }}'#" app/scripts/settings.coffee
+        sed -i "s#API_DOMAIN.*#API_DOMAIN: '${{ vars.DEPLOY_API_DOMAIN }}'#" app/scripts/settings.coffee
+        sed -i "s#S3_BUCKET_URL.*#S3_BUCKET_URL: '${{ vars.DEPLOY_S3_BUCKET_URL }}'#" app/scripts/settings.coffee
+        sed -i "s#GOOGLE_MAPS_API_KEY#${{ vars.GOOGLE_MAPS_API_KEY }}#" app/index.html
+        sed -i "s#ga('create', 'UA-XXXXX-X');#ga('create', '${{ vars.DEPLOY_GOOGLE_ANALYTICS_ID }}');#" app/index.html
+        sed -i "s#vigiechiro {version}#vigiechiro rev `date -u +'%Y-%m-%dT%H:%M:%SZ'`#" app/index.html
+
+    - name: Build
+      run: |
+        grunt build
+
+    - name: Deploy
+      run: |
+        awscli s3 sync \
+          ./dist \
+          s3://${{ vars.DEPLOY_S3_BUCKET_NAME }} \
+          --region ${{ vars.DEPLOY_S3_REGION }} \
+          --acl public-read
+      env:
+        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}