diff --git a/.bazelrc b/.bazelrc
index 1499cb2..38717e9 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -2,4 +2,19 @@ common --experimental_repository_cache_hardlinks
 common --repo_env=BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
 common --repo_env=BAZEL_USE_XCODE_TOOLCHAIN=0
 
+build:remote-cache --bes_results_url=https://oliverlee.buildbuddy.io/invocation/
+build:remote-cache --bes_backend=grpcs://oliverlee.buildbuddy.io
+build:remote-cache --bes_upload_mode=fully_async
+build:remote-cache --remote_cache=grpcs://oliverlee.buildbuddy.io
+build:remote-cache --remote_timeout=10m
+build:remote-cache --remote_build_event_upload=minimal
+build:remote-cache --remote_download_outputs=minimal
+build:remote-cache --remote_cache_compression
+build:remote-cache --slim_profile=false
+build:remote-cache --experimental_profile_include_primary_output
+build:remote-cache --experimental_profile_include_target_label
+build:remote-cache --legacy_important_outputs=false
+
 test --test_output=errors
+
+try-import %workspace%/user.bazelrc
diff --git a/.github/actions/ci-env-setup/action.yml b/.github/actions/ci-env-setup/action.yml
new file mode 100644
index 0000000..ecc38a0
--- /dev/null
+++ b/.github/actions/ci-env-setup/action.yml
@@ -0,0 +1,42 @@
+name: "CI environment setup"
+description: |
+  * set home bazelrc for CI runner
+  * set buildbuddy api key
+  * setup vendored external deps
+
+inputs:
+  buildbuddy-api-key:
+    required: true
+    description: |
+      BuildBuddy API key to access the remote cache.
+  external-cache-key:
+    default: ${{ runner.os }}-default
+    description: |
+      Key specifying which cache to restore.
+
+runs:
+  using: "composite"
+  steps:
+    - uses: nixbuild/nix-quick-install-action@v32
+
+    - name: setup ci bazelrc
+      shell: bash
+      run: |
+        cp .github/workflows/ci.bazelrc ~/.bazelrc
+        echo 'build:remote-cache --remote_header=x-buildbuddy-api-key=${{ inputs.buildbuddy-api-key }}' >> ~/.bazelrc
+
+    - name: setup bazel vendored external deps
+      shell: bash
+      run: |
+        echo "common --vendor_dir=$HOME/bazel_external_deps" >> ~/.bazelrc
+
+    - name: restore bazel vendored external deps
+      uses: nix-community/cache-nix-action/restore@v6
+      with:
+        paths: |
+          ~/bazel_external_deps
+          /nix
+          ~/.cache/nix
+          ~root/.cache/nix
+        primary-key: bazel-external-cache-${{ inputs.external-cache-key }}
+        save: false
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
new file mode 100644
index 0000000..0804ff1
--- /dev/null
+++ b/.github/workflows/check.yml
@@ -0,0 +1,50 @@
+name: check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ["*"]
+    types: [synchronize, opened, reopened, edited]
+  workflow_dispatch:
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - 'ubuntu-latest'
+          - 'macos-latest'
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/ci-env-setup
+      with:
+        buildbuddy-api-key: ${{ secrets.BUILDBUDDY_API_KEY }}
+    - run: |
+        bazel test //...
+
+  buildifier:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/ci-env-setup
+      with:
+        buildbuddy-api-key: ${{ secrets.BUILDBUDDY_API_KEY }}
+    - run: |
+        bazel run //tools:buildifier
+
+  # https://emmer.dev/blog/skippable-github-status-checks-aren-t-really-required/
+  # https://github.com/marketplace/actions/alls-green
+  all:
+    runs-on: ubuntu-latest
+    if: always()
+    needs:
+      - test
+      - buildifier
+    steps:
+    - uses: Kesin11/actions-timeline@v2
+    - uses: re-actors/alls-green@release/v1
+      with:
+        jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
new file mode 100644
index 0000000..915c1a6
--- /dev/null
+++ b/.github/workflows/ci.bazelrc
@@ -0,0 +1,14 @@
+common --build_metadata=ROLE=CI
+
+build --show_timestamps
+build --announce_rc
+build --color=yes
+build --curses=no
+build --terminal_columns=120
+build --verbose_failures
+
+build:remote-cache --remote_upload_local_results=true
+build:remote-cache --remote_instance_name=ci-runner-rules_multitransition-0
+build --config=remote-cache
+
+test --test_output=errors
diff --git a/.gitignore b/.gitignore
index a6b01ca..394397d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /bazel-*
 /examples/*/bazel-*
+/user.bazelrc
diff --git a/REPO.bazel b/REPO.bazel
index ba4aa9d..2b97460 100644
--- a/REPO.bazel
+++ b/REPO.bazel
@@ -1,3 +1,6 @@
+"""repo settings
+"""
+
 ignore_directories([
     "**/bazel-*",
 ])