diff --git a/.github/main.workflow b/.github/main.workflow
new file mode 100644
index 0000000..1bf97bf
--- /dev/null
+++ b/.github/main.workflow
@@ -0,0 +1,19 @@
+workflow "Run tests" {
+  on = "push"
+  resolves = ["Shellcheck", "Bats", "Dockerfilelint"]
+}
+
+action "Shellcheck" {
+  uses = "actions/bin/shellcheck@master"
+  args = "entrypoint.sh"
+}
+
+action "Bats" {
+  uses = "actions/bin/bats@master"
+  args = "test/*.bats"
+}
+
+action "Dockerfilelint" {
+  uses = "docker://replicated/dockerfilelint"
+  args = ["Dockerfile"]
+}
diff --git a/test/bin/dnscontrol b/test/bin/dnscontrol
new file mode 100644
index 0000000..e65e27d
--- /dev/null
+++ b/test/bin/dnscontrol
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "foo"
diff --git a/test/bootstrap.bash b/test/bootstrap.bash
new file mode 100644
index 0000000..9e461aa
--- /dev/null
+++ b/test/bootstrap.bash
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+apt update && apt install --no-install-recommends -y jq >&2
diff --git a/test/entrypoint.bats b/test/entrypoint.bats
new file mode 100644
index 0000000..0bc58dd
--- /dev/null
+++ b/test/entrypoint.bats
@@ -0,0 +1,48 @@
+#!/usr/bin/env bats
+
+load bootstrap
+
+PATH="$PATH:$BATS_TEST_DIRNAME/bin"
+
+function setup() {
+  export WORKSPACE="${WORKSPACE-"${BATS_TEST_DIRNAME}/.."}"
+}
+
+function teardown() {
+  rm creds.json
+}
+
+function assert_jq_eq {
+  MATCH=$2
+  RESULT=$(jq -r "$1" < creds.json)
+
+  if [[ "$RESULT" != "$MATCH" ]]
+  then
+    echo "Expected match "'"'"$MATCH"'"'" was not found in "'"'"$RES"'"'
+    return 1
+  fi
+}
+
+@test "cloudflare default" {
+  export CLOUDFLARE_API_USER="info@example.com"
+  export CLOUDFLARE_API_KEY="foo"
+
+  run $WORKSPACE/entrypoint.sh
+
+  assert_jq_eq ".cloudflare.apiuser" "\$CLOUDFLARE_API_USER"
+  assert_jq_eq ".cloudflare.apikey" "\$CLOUDFLARE_API_KEY"
+}
+
+@test "Cloudflare account ID and name only set when both are specified" {
+  export CLOUDFLARE_API_USER="info@example.com"
+  export CLOUDFLARE_API_KEY="foo"
+  export CLOUDFLARE_ACCOUNT_ID="1"
+  export CLOUDFLARE_ACCOUNT_NAME="Contoso"
+
+  run $WORKSPACE/entrypoint.sh
+
+  assert_jq_eq ".cloudflare.apiuser" "\$CLOUDFLARE_API_USER"
+  assert_jq_eq ".cloudflare.apikey" "\$CLOUDFLARE_API_KEY"
+  assert_jq_eq ".cloudflare.accountid" "\$CLOUDFLARE_ACCOUNT_ID"
+  assert_jq_eq ".cloudflare.accountname" "\$CLOUDFLARE_ACCOUNT_NAME"
+}