diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..ec55deca
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,32 @@
+name: CI
+on:
+  pull_request:
+  workflow_dispatch:
+jobs:
+  CI:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v2
+
+      # build CDK first to ensure the template is on disk for SBT to pick up
+      - name: Use Node.js 14.15.5
+        uses: actions/setup-node@v2.4.0
+        with:
+          node-version: 14.15.5
+      - name: Generate CDK
+        working-directory: ./cdk
+        run: ./script/ci
+
+      - uses: guardian/actions-assume-aws-role@hackday
+        with:
+          awsRoleToAssume: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
+
+      - name: Set up JDK 11
+        uses: actions/setup-java@v2
+        with:
+          java-version: '11'
+          distribution: 'adopt'
+      - run: ./scripts/ci
diff --git a/cdk/script/ci b/cdk/script/ci
index 1de62367..a93ca818 100755
--- a/cdk/script/ci
+++ b/cdk/script/ci
@@ -2,25 +2,6 @@
 
 set -e
 
-nvm_available() {
-  type -t nvm > /dev/null
-}
-
-source_nvm() {
-  if ! nvm_available; then
-    [ -e "/usr/local/opt/nvm/nvm.sh" ] && source /usr/local/opt/nvm/nvm.sh
-  fi
-  if ! nvm_available; then
-    [ -e "$HOME/.nvm/nvm.sh" ] && source "$HOME/.nvm/nvm.sh"
-  fi
-}
-
-source_nvm
-nvm install
-nvm use
-
-npm install -g yarn
-
 yarn install --frozen-lockfile
 yarn lint
 yarn build
diff --git a/scripts/ci b/scripts/ci
index 4bdf73fb..a0910c4c 100755
--- a/scripts/ci
+++ b/scripts/ci
@@ -7,10 +7,10 @@ if [[ ! -z "${TEAMCITY_VERSION}" ]]; then
   exit 0
 fi
 
-# build CDK first to ensure it is on disk for SBT to pick up
-(
-  cd cdk
-  ./script/ci
-)
+## build CDK first to ensure it is on disk for SBT to pick up
+#(
+#  cd cdk
+#  ./script/ci
+#)
 
 sbt clean compile test riffRaffUpload