diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000000..f346aa0d82
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,28 @@
+name: CI
+
+on: [push, pull_request]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Clone Flutter SDK
+      # We can't do a depth-1 clone, because we need the most recent tag
+      # so that Flutter knows its version and sees the constraint in our
+      # pubspec is satisfied.  It's uncommon for flutter/flutter to go
+      # more than 100 commits between tags.  Fetch 1000 for good measure.
+      run: |
+        git clone --depth=1000 https://github.com/flutter/flutter ~/flutter
+        TZ=UTC git --git-dir ~/flutter/.git log -1 --format='%h | %ci | %s' --date=iso8601-local
+        echo ~/flutter/bin >> "$GITHUB_PATH"
+
+    - name: Download Flutter SDK artifacts (flutter precache)
+      run: flutter precache --universal
+
+    - name: Download our dependencies (flutter pub get)
+      run: flutter pub get
+
+    - name: Run tools/check
+      run: TERM=dumb tools/check --all --verbose
diff --git a/lib/model/database.dart b/lib/model/database.dart
index 5bc257b7f5..d95b6f4817 100644
--- a/lib/model/database.dart
+++ b/lib/model/database.dart
@@ -52,13 +52,10 @@ class AppDatabase extends _$AppDatabase {
 
   // When updating the schema:
   //  * Make the change in the table classes, and bump schemaVersion.
-  //  * Export the new schema:
-  //    $ dart run drift_dev schema dump lib/model/database.dart test/model/schemas/
-  //  * Generate test migrations from the schemas:
-  //    $ dart run drift_dev schema generate --data-classes --companions test/model/schemas/ test/model/schemas/
+  //  * Export the new schema and generate test migrations:
+  //    $ tools/check --fix drift
   //  * Write a migration in `onUpgrade` below.
   //  * Write tests.
-  // TODO run those `drift_dev schema` commands in CI: https://github.com/zulip/zulip-flutter/issues/60
   @override
   int get schemaVersion => 2; // See note.
 
diff --git a/lib/widgets/icons.dart b/lib/widgets/icons.dart
index 1d599bfb91..b9553c643d 100644
--- a/lib/widgets/icons.dart
+++ b/lib/widgets/icons.dart
@@ -16,7 +16,7 @@ abstract final class ZulipIcons {
   //    or otherwise edit the SVG files there.
   //    The files' names (before ".svg") should be valid Dart identifiers.
   //
-  //  * Then run the command `scripts/icons/build-icon-font`.
+  //  * Then run the command `tools/icons/build-icon-font`.
   //    That will update this file and the generated icon font,
   //    `assets/icons/ZulipIcons.ttf`.
   //
diff --git a/test/model/schemas/drift_schema_v2.json b/test/model/schemas/drift_schema_v2.json
index 4d639ddead..8d184f229b 100644
--- a/test/model/schemas/drift_schema_v2.json
+++ b/test/model/schemas/drift_schema_v2.json
@@ -1 +1 @@
-{"_meta":{"description":"This file contains a serialized version of schema entities for drift.","version":"1.0.0"},"options":{"store_date_time_values_as_text":false},"entities":[{"id":0,"references":[],"type":"table","data":{"name":"accounts","was_declared_in_moor":false,"columns":[{"name":"id","getter_name":"id","moor_type":"int","nullable":false,"customConstraints":null,"defaultConstraints":"PRIMARY KEY AUTOINCREMENT","default_dart":null,"default_client_dart":null,"dsl_features":["auto-increment"]},{"name":"realm_url","getter_name":"realmUrl","moor_type":"string","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"user_id","getter_name":"userId","moor_type":"int","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"email","getter_name":"email","moor_type":"string","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"api_key","getter_name":"apiKey","moor_type":"string","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"zulip_version","getter_name":"zulipVersion","moor_type":"string","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"zulip_merge_base","getter_name":"zulipMergeBase","moor_type":"string","nullable":true,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"zulip_feature_level","getter_name":"zulipFeatureLevel","moor_type":"int","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"acked_push_token","getter_name":"ackedPushToken","moor_type":"string","nullable":true,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]}],"is_virtual":false,"without_rowid":false,"constraints":[],"unique_keys":[["realm_url","user_id"],["realm_url","email"]]}}]}
\ No newline at end of file
+{"_meta":{"description":"This file contains a serialized version of schema entities for drift.","version":"1.0.0"},"options":{"store_date_time_values_as_text":false},"entities":[{"id":0,"references":[],"type":"table","data":{"name":"accounts","was_declared_in_moor":false,"columns":[{"name":"id","getter_name":"id","moor_type":"int","nullable":false,"customConstraints":null,"defaultConstraints":"PRIMARY KEY AUTOINCREMENT","default_dart":null,"default_client_dart":null,"dsl_features":["auto-increment"]},{"name":"realm_url","getter_name":"realmUrl","moor_type":"string","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[],"type_converter":{"dart_expr":"const UriConverter()","dart_type_name":"Uri"}},{"name":"user_id","getter_name":"userId","moor_type":"int","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"email","getter_name":"email","moor_type":"string","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"api_key","getter_name":"apiKey","moor_type":"string","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"zulip_version","getter_name":"zulipVersion","moor_type":"string","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"zulip_merge_base","getter_name":"zulipMergeBase","moor_type":"string","nullable":true,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"zulip_feature_level","getter_name":"zulipFeatureLevel","moor_type":"int","nullable":false,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]},{"name":"acked_push_token","getter_name":"ackedPushToken","moor_type":"string","nullable":true,"customConstraints":null,"default_dart":null,"default_client_dart":null,"dsl_features":[]}],"is_virtual":false,"without_rowid":false,"constraints":[],"unique_keys":[["realm_url","user_id"],["realm_url","email"]]}}]}
\ No newline at end of file
diff --git a/tools/check b/tools/check
new file mode 100755
index 0000000000..d1a89e854c
--- /dev/null
+++ b/tools/check
@@ -0,0 +1,381 @@
+#!/usr/bin/env bash
+
+# Careful! `set -e` doesn't do everything you'd think it does. In
+# fact, we don't get its benefit in any of the `run_foo` functions.
+#
+# This is because it has an effect only when it can exit the whole shell.
+# (Its full name is `set -o errexit`, and it means "exit" literally.)  See:
+#   https://www.gnu.org/software/bash/manual/bash.html#The-Set-Builtin
+#
+# When one test suite fails, we want to go on to run the other suites, so
+# we use `||` to prevent the whole script from exiting there, and that
+# defeats `set -e`.
+#
+# For now our workaround is to put `|| return` in the `run_foo` just
+# after each nontrivial command that isn't the final command in the
+# function.
+set -euo pipefail
+
+this_dir=${BASH_SOURCE[0]%/*}
+
+# shellcheck source=tools/lib/git.sh
+. "${this_dir}"/lib/git.sh
+
+
+## CLI PARSING
+
+default_suites=(analyze test build_runner drift icons)
+extra_suites=(
+    shellcheck  # Requires its own dependency, from outside the pub system.
+)
+
+usage() {
+    cat >&2 <<EOF
+usage: tools/check [OPTION]... [SUITE]...
+
+Run our tests.
+
+By default, run only on files changed in this branch
+as compared to the upstream \`main\`.
+
+By default, run ${#default_suites[@]} suite(s):
+  ${default_suites[*]}
+and skip ${#extra_suites[@]} suite(s):
+  ${extra_suites[*]}
+
+What tests to run:
+  --all-files
+              Run on all files, not only changed files.
+  --diff COMMIT
+              Run only on files that differ from the given commit.
+              (E.g., \`--diff @\` for files with uncommitted changes;
+              \`--diff @~10\` for files changed in last 10 commits; or see
+              \`git help revisions\` for many more ways to name a commit.)
+  --all       In the given suites, run on all files. If no list of suites
+              was specified, run all suites.
+
+Extra things to do:
+  --fix       Fix issues found, where possible.
+
+Modifying this script's output:
+  --verbose   Print more details about everything.
+EOF
+    exit 2
+}
+
+orig_cmdline="$0 $*"
+
+opt_files=branch
+opt_all=
+opt_fix=
+opt_verbose=
+opt_suites=()
+while (( $# )); do
+    case "$1" in
+        --diff) shift; opt_files=diff:"$1"; shift;;
+        --all-files) opt_files=all; shift;;
+        --all) opt_files=all; opt_all=1; shift;;
+        --fix) opt_fix=1; shift;;
+        --verbose) opt_verbose=1; shift;;
+        analyze|test|build_runner|drift|icons|shellcheck)
+            opt_suites+=("$1"); shift;;
+        *) usage;;
+    esac
+done
+
+if (( ! "${#opt_suites[@]}" )); then
+    if [ -n "${opt_all}" ]; then
+        opt_suites=( "${default_suites[@]}" "${extra_suites[@]}" )
+    else
+        opt_suites=( "${default_suites[@]}" )
+    fi
+fi
+
+files_base_commit=
+# shellcheck disable=SC2119  # this is a silly warning
+case "$opt_files" in
+    all) ;;
+    branch) files_base_commit="$(git_base_commit)";;
+    diff:*) files_base_commit="${opt_files#diff:}";;
+esac
+
+
+## EXECUTION
+
+rootdir=$(git rev-parse --show-toplevel)
+cd "$rootdir"
+
+divider_line='================================================================'
+
+# usage: if_verbose COMMAND...
+#
+# Run the given command just if $opt_verbose; else do nothing.
+#
+# This is a convenience shorthand for simple commands.  For more complex logic,
+# write `if [ -n "${opt_verbose}" ]` directly.
+if_verbose() {
+  if [ -n "${opt_verbose}" ]; then
+    "$@"
+  fi
+}
+
+# True just if $opt_files intersects the given set of paths.
+#
+# On what paths to include in this check (and more generally, how to write
+# conditions to implement `--diff`): Aim to cover perhaps 95% or 99% of the
+# changes in practice that would affect the outcome of the suite, but not 100%.
+#
+# In particular, omit pubspec.yaml, pubspec.lock, and tools/check itself,
+# except where the suite is specifically aimed at those files.
+#
+# It's OK to cover less than 100% because those changes will be caught in CI
+# using `--all` (or even by the developer using `--all` locally, out of a suspicion
+# that their change affects the suite).  And predicting which changes could matter,
+# short of simply running the suite, is usually imprecise; so covering the last
+# few edge cases would come at the cost of running on a lot of changes that are
+# very unlikely to matter, like unrelated changes in pubspec.lock.
+#
+# Do, though, write down in a comment the known types of changes that could affect
+# the outcome and are being left out.  That's helpful when either revising which
+# changes we choose to omit, or debugging inadvertent omissions, by separating
+# the two from each other.
+files_check() {
+    case "$opt_files" in
+        all)
+            ;;
+        branch | diff:*)
+            ! git diff --quiet "${files_base_commit}" -- "$@"
+            ;;
+    esac
+}
+
+# usage: check_no_changes CHANGE_DESCRIPTION [GIT_PATHSPECS...]
+#
+# Check that there were no changes to files matching GIT_PATHSPECS.
+# With `--fix`, describe the changes but leave them in place;
+# otherwise any changes get cleaned up but cause failure.
+#
+# This is useful for suites that check that some generated files
+# in the tree are up to date.  Such a suite might regenerate the
+# files, then call `check_no_changes` on the outputs to check that
+# they match what was already in the tree.  Typically it also calls
+# `check_no_uncommitted_or_untracked` on the same output paths
+# before regenerating, to avoid clobbering any existing changes.
+#
+# A Git pathspec (as in GIT_PATHSPECS) is a filename, directory,
+# or other pattern describing a subset of paths in the Git tree or worktree,
+# to be passed as positional arguments to `git diff`, `git clean`, and
+# many other Git commands.  For docs, see `git help glossary` under "pathspec".
+#
+# The CHANGE_DESCRIPTION is used in the error message on failure,
+# or the informational message when `--fix` is triggered.
+check_no_changes() {
+    local change_description="$1"; shift
+
+    if git diff --quiet -- "$@" \
+            && no_untracked_files "$@"; then
+        return
+    fi
+
+    if [ -n "${opt_fix}" ]; then
+        echo >&2 "There were ${change_description}:"
+        git_status_short "$@"
+    else
+        echo >&2 "Error: there were ${change_description}:"
+        git_status_short "$@"
+        git checkout HEAD -- "$@"
+        git clean -fd --quiet -- "$@"
+        return 1
+    fi
+}
+
+run_analyze() {
+    # no `flutter analyze --verbose` even when $opt_verbose; it's *very* verbose
+    flutter analyze
+}
+
+run_test() {
+    # no `flutter test --verbose` even when $opt_verbose; it's *very* verbose
+    flutter test
+}
+
+# Whether the build_runner suite should run, given $opt_files.
+should_run_build_runner() {
+    # First, check for changes in relevant metadata.
+    # Omitted from this files_check:
+    #   pubspec.{yaml,lock} tools/check
+    if files_check build.yaml; then
+        return 0;
+    fi
+
+    # Otherwise, check for changes in the input files of build_runner.
+    # These input files should have `part "foo.g.dart"` directives.
+    # Omitted from this check: any files where that isn't yet added.
+    # (And at this point we must have a meaningful $files_base_commit.)
+    if git_changed_files "${files_base_commit}" \
+            | xargs -r git grep -l '^part .*g\.dart.;$' \
+            | grep -q .; then
+        return 0
+    fi
+
+    # No relevant changes found.
+    return 1
+}
+
+run_build_runner() {
+    should_run_build_runner \
+    || return 0
+
+    check_no_uncommitted_or_untracked '*.g.dart' \
+    || return
+
+    local build_runner_cmd=(
+        dart run build_runner build --delete-conflicting-outputs
+    )
+    if [ -n "${opt_verbose}" ]; then
+        # No --verbose needed; build_runner is verbose enough by default.
+        "${build_runner_cmd[@]}" \
+        || return
+    else
+        # build_runner lacks a --quiet, and is fairly verbose to begin with.
+        # So we filter out "[INFO]" messages ourselves.
+        "${build_runner_cmd[@]}" \
+        | perl -lne '
+            BEGIN { my $silence = 0 }
+            if (/^\[INFO\]/) { $silence = 1 }
+            elsif (/^\[[A-Z]/) { $silence = 0 }
+            print if (!$silence)
+          ' \
+        || return
+    fi
+
+    check_no_changes "updates to *.g.dart files" '*.g.dart'
+}
+
+run_drift() {
+    local schema_dir=test/model/schemas/
+
+    # Omitted from this check:
+    #   pubspec.{yaml,lock} tools/check
+    files_check lib/model/database{,.g}.dart "${schema_dir}" \
+    || return 0
+
+    check_no_uncommitted_or_untracked "${schema_dir}" \
+    || return
+
+    dart run drift_dev schema dump \
+        lib/model/database.dart "${schema_dir}" \
+    || return
+    dart run drift_dev schema generate --data-classes --companions \
+        "${schema_dir}" "${schema_dir}" \
+    || return
+
+    check_no_changes "schema updates" "${schema_dir}"
+}
+
+run_icons() {
+    # Omitted from this check:
+    #   pubspec.{yaml,lock} tools/check
+    files_check tools/icons/ assets/icons/ lib/widgets/icons.dart \
+    || return 0
+
+    local outputs=( assets/icons/ZulipIcons.ttf lib/widgets/icons.dart )
+
+    check_no_uncommitted_or_untracked "${outputs[@]}" \
+    || return
+
+    tools/icons/build-icon-font
+
+    check_no_changes "icon updates" "${outputs[@]}"
+}
+
+run_shellcheck() {
+    # Omitted from this check: nothing (nothing known, anyway).
+    files_check tools/ '!*.'{dart,js,json} \
+    || return 0
+
+    # Shellcheck is fast, <1s; so if we touched any possible targets at all,
+    # just run on the full list of targets.
+    # shellcheck disable=SC2207  # filenames in our own tree, assume well-behaved
+    targets=(
+        $(git grep -l '#!.*sh\b' -- tools/)
+        $(git ls-files -- tools/'*.sh')
+    )
+
+    if ! type shellcheck >/dev/null 2>&1; then
+        cat >&2 <<EOF
+shellcheck: command not found
+
+Consider installing Shellcheck:
+  https://github.com/koalaman/shellcheck#installing
+
+Alternatively, skip running the \`shellcheck\` suite.
+See \`tools/check --help\`.
+EOF
+        return 1
+    fi
+
+    if_verbose shellcheck --version
+    shellcheck -x --shell=bash -- "${targets[@]}"
+}
+
+describe_git_head() {
+    local name="$1" repo_path="$2"
+    local commit_data
+    commit_data=$(
+        TZ=UTC \
+        git --git-dir "${repo_path}" \
+            log -1 --format="%h • %cd" \
+            --abbrev=9 --date=iso8601-local
+    )
+    echo "${name} ${commit_data}"
+}
+
+print_header() {
+    local flutter_executable flutter_tree
+
+    echo "Test command: ${orig_cmdline}"
+
+    echo "Time now: $(date --utc +'%F %T %z')"
+
+    describe_git_head "zulip-flutter" .git/
+
+    # We avoid `flutter --version` because, weirdly, when run in a
+    # GitHub Actions step it takes about 30 seconds.  (The first time;
+    # it's fast subsequent times.)  That's even after `flutter precache`.
+    flutter_executable=$(readlink -f "$(type -p flutter)")
+    flutter_tree=${flutter_executable%/bin/flutter}
+    describe_git_head "flutter/flutter" "${flutter_tree}"/.git
+
+    dart --version
+}
+
+if_verbose print_header
+failed=()
+for suite in "${opt_suites[@]}"; do
+    if_verbose echo "${divider_line}"
+    echo "Running $suite..."
+    case "$suite" in
+        analyze)      run_analyze ;;
+        test)         run_test ;;
+        build_runner) run_build_runner ;;
+        drift)        run_drift ;;
+        icons)        run_icons ;;
+        shellcheck)   run_shellcheck ;;
+        *)            echo >&2 "Internal error: unknown suite $suite" ;;
+    esac || failed+=( "$suite" )
+done
+if_verbose echo "${divider_line}"
+
+if (( ${#failed[@]} )); then
+    cat >&2 <<EOF
+
+FAILED: ${failed[*]}
+
+To rerun the suites that failed, run:
+  $ tools/check ${failed[*]}
+EOF
+    exit 1
+fi
+
+echo "Passed!"
diff --git a/scripts/icons/.gitignore b/tools/icons/.gitignore
similarity index 100%
rename from scripts/icons/.gitignore
rename to tools/icons/.gitignore
diff --git a/scripts/icons/build-icon-font b/tools/icons/build-icon-font
similarity index 100%
rename from scripts/icons/build-icon-font
rename to tools/icons/build-icon-font
diff --git a/scripts/icons/build-icon-font.js b/tools/icons/build-icon-font.js
similarity index 100%
rename from scripts/icons/build-icon-font.js
rename to tools/icons/build-icon-font.js
diff --git a/scripts/icons/package-lock.json b/tools/icons/package-lock.json
similarity index 100%
rename from scripts/icons/package-lock.json
rename to tools/icons/package-lock.json
diff --git a/scripts/icons/package.json b/tools/icons/package.json
similarity index 100%
rename from scripts/icons/package.json
rename to tools/icons/package.json
diff --git a/tools/lib/git.sh b/tools/lib/git.sh
new file mode 100644
index 0000000000..b8b95d3394
--- /dev/null
+++ b/tools/lib/git.sh
@@ -0,0 +1,86 @@
+# shellcheck shell=bash
+#
+# Shell functions for use with Git.
+
+no_uncommitted_changes()
+{
+    if ! git diff-index --quiet --cached HEAD -- "$@"; then
+        # Index differs from HEAD.
+        return 1
+    fi
+    if ! git diff-files --quiet -- "$@"; then
+        # Worktree differs from index.
+        return 1
+    fi
+}
+
+no_untracked_files()
+{
+    if git ls-files --others --exclude-standard -- "$@" \
+            | grep -q .; then
+        return 1
+    fi
+}
+
+git_status_short()
+{
+    # --untracked-files=normal is the default; but the user's local config
+    # may have overridden it, so we specify explicitly.
+    git status --short --untracked-files=normal -- "$@"
+}
+
+check_no_uncommitted_or_untracked()
+{
+    local problem=""
+    if ! no_uncommitted_changes "$@"; then
+        problem="uncommitted changes"
+    elif ! no_untracked_files "$@"; then
+        problem="untracked files"
+    else
+        return 0
+    fi
+
+    local qualifier=
+    if (( $# )); then
+        qualifier=" in $*"
+    fi
+    echo >&2 "There are ${problem}${qualifier}:"
+    echo >&2
+    git_status_short "$@"
+    echo >&2
+    echo >&2 "Aborting, to avoid losing your work."
+    return 1
+}
+
+# Compute what remote name is being used for the upstream repo.
+git_upstream_remote_name() {
+    # Out of the names listed by `git remote`, pick one from the
+    # list below, in preference order.
+    grep -m1 -xFf <(git remote) <<EOF
+upstream
+origin
+EOF
+}
+
+git_upstream_ref() {
+    echo refs/remotes/"$(git_upstream_remote_name)"/main
+}
+
+# usage: git_base_commit [TIP [UPSTREAM]]
+#
+# The merge-base of TIP (default: current HEAD) with
+# UPSTREAM (default: upstream/main or origin/main).
+git_base_commit() {
+    tip_commit=${1:-@}
+    upstream=${2:-$(git_upstream_ref)}
+    git merge-base "$tip_commit" "$upstream"
+}
+
+# usage: git_changed_files [DIFFARGS..]
+#
+# Lists files that have changed, excluding files that no longer exist.
+#
+# Arguments are passed through to `git diff`.
+git_changed_files() {
+    git diff --name-only --diff-filter=d "$@"
+}