diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d2ae84c..685824c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,17 +1,42 @@
-name: CI Workflow
+name: CI
+
 on:
   push:
-    branches:
-      - main
-  pull_request: {}
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
-  test:
-    name: Test
+  quality:
+    name: Quality checks
     runs-on: ubuntu-latest
+
     steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - name: Hello World
-        run: echo "Hello from my construct!"
-      - name: Show Environment
-        run: 'echo "Environment: production"'
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.2.22
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build
+        run: bun run build
+
+      - name: Typecheck
+        run: bun run typecheck
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Contract tests (workflow generator)
+        run: bun run test -- packages/core/src/workflow-generator.test.ts
diff --git a/package.json b/package.json
index 1a04a79..80f1ddd 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,10 @@
   "type": "module",
   "private": true,
   "scripts": {
-    "build": "bun run --filter './packages/*' build",
+    "build": "bun run --filter @dotgithub/core build && bun run --filter @dotgithub/cli build",
+    "typecheck": "bun run build",
+    "lint": "echo 'lint rules pending (tracked in backlog)'",
+    "format:check": "bunx prettier --check .",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:ui": "vitest --ui",
@@ -32,7 +35,7 @@
   "peerDependencies": {
     "typescript": "^5"
   },
-  "packageManager": "bun@1.1.40",
+  "packageManager": "bun@1.2.22",
   "dependencies": {
     "@changesets/cli": "^2.29.5",
     "axios": "^1.7.0",
diff --git a/packages/core/src/__snapshots__/workflow-generator.test.ts.snap b/packages/core/src/__snapshots__/workflow-generator.test.ts.snap
new file mode 100644
index 0000000..9625f72
--- /dev/null
+++ b/packages/core/src/__snapshots__/workflow-generator.test.ts.snap
@@ -0,0 +1,28 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`workflow-generator > generateWorkflowYaml > should keep workflow/job/step key ordering stable 1`] = `
+"# This file is autogenerated by DotGitHub. Do not edit manually.
+name: Ordered Workflow
+on:
+  push:
+    branches:
+      - main
+permissions:
+  actions: read
+  contents: read
+env:
+  CI: "true"
+concurrency:
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  test:
+    name: Test Job
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run tests
+        run: bun test
+"
+`;
diff --git a/packages/core/src/workflow-generator.test.ts b/packages/core/src/workflow-generator.test.ts
index 4a34c16..87c3637 100644
--- a/packages/core/src/workflow-generator.test.ts
+++ b/packages/core/src/workflow-generator.test.ts
@@ -185,6 +185,41 @@ describe('workflow-generator', () => {
       expect(yaml).toContain('continue-on-error: true');
       expect(yaml).toContain('working-directory: ./src');
     });
+
+    it('should keep workflow/job/step key ordering stable', () => {
+      const workflow: GitHubWorkflow = {
+        name: 'Ordered Workflow',
+        on: {
+          push: { branches: ['main'] },
+        },
+        permissions: {
+          contents: 'read',
+          actions: 'read',
+        },
+        env: {
+          CI: 'true',
+        },
+        concurrency: {
+          group: '${{ github.workflow }}-${{ github.ref }}',
+          'cancel-in-progress': true,
+        },
+        jobs: {
+          test: {
+            name: 'Test Job',
+            permissions: { contents: 'read' },
+            'runs-on': 'ubuntu-latest',
+            steps: [
+              {
+                name: 'Run tests',
+                run: 'bun test',
+              },
+            ],
+          },
+        },
+      };
+
+      expect(generateWorkflowYaml(workflow)).toMatchSnapshot();
+    });
   });
 
   describe('createWorkflow', () => {