diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 00000000..6439a153
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,33 @@
+name: Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  lint:
+    if: github.event_name == 'push' || github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.13"
+          enable-cache: true
+          activate-environment: true
+
+      - name: Configure git credentials for private ASTRA repo
+        run: git config --global url."https://x-access-token:${{ secrets.ASP_TOKEN }}@github.com/".insteadOf "https://github.com/"
+
+      - name: Install dependencies
+        run: uv sync --group dev
+
+      - name: Ruff
+        run: ruff check src/ tests/
+
+      - name: Mypy
+        run: mypy src/
diff --git a/pyproject.toml b/pyproject.toml
index 4f5f1212..93265ef8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -89,7 +89,16 @@ ignore_missing_imports = true
 follow_untyped_imports = true
 
 [[tool.mypy.overrides]]
-module = ["rocrate.*", "astra.*"]
+module = ["rocrate.*"]
+ignore_missing_imports = true
+
+[[tool.mypy.overrides]]
+module = ["astra.*"]
+ignore_missing_imports = true
+follow_untyped_imports = true
+
+[[tool.mypy.overrides]]
+module = ["daytona_sdk", "daytona_sdk.*", "dotenv", "dotenv.*"]
 ignore_missing_imports = true
 
 [tool.pytest.ini_options]
diff --git a/src/lightcone/cli/commands.py b/src/lightcone/cli/commands.py
index e528c6fd..b9328c15 100644
--- a/src/lightcone/cli/commands.py
+++ b/src/lightcone/cli/commands.py
@@ -172,7 +172,7 @@ def init(
     # src/. We hold off on git init until our own files are in place so
     # the initial commit captures the full project state.
     try:
-        astra_init.callback(directory=directory, no_git=True)
+        astra_init.callback(directory=directory, no_git=True)  # type: ignore[misc]
     except SystemExit as e:
         raise click.ClickException(
             f"astra init failed (exit code {e.code})."
diff --git a/src/lightcone/eval/build.py b/src/lightcone/eval/build.py
index 499e959f..92ace88a 100644
--- a/src/lightcone/eval/build.py
+++ b/src/lightcone/eval/build.py
@@ -45,11 +45,11 @@ def _get_git_info(repo_root: Path) -> VersionInfo:
         pass
 
     try:
-        result = subprocess.run(
+        dirty = subprocess.run(
             ["git", "diff", "--quiet", "HEAD"],
             capture_output=True, cwd=repo_root,
         )
-        info.lightcone_dirty = result.returncode != 0
+        info.lightcone_dirty = dirty.returncode != 0
     except subprocess.CalledProcessError:
         info.lightcone_dirty = True