diff --git a/.github/workflows/rust-library.yaml b/.github/workflows/rust-library.yaml
new file mode 100644
index 0000000..f719640
--- /dev/null
+++ b/.github/workflows/rust-library.yaml
@@ -0,0 +1,61 @@
+# Managed by infra via Terraform, edits will be lost
+name: rust-library
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+env:
+  CARGO_NET_GIT_FETCH_WITH_CLI: true
+jobs:
+  test:
+    name: rust
+    runs-on: ubuntu-latest-8-cores
+    if: github.actor != 'lyft-lhouse-terraform[bot]'
+    strategy:
+      matrix:
+        rust: ['stable']
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      # Get a token that can be used for org read-only clones.
+      - name: org-read-only-install token
+        id: org-read-only
+        uses: getsentry/action-github-app-token@v2
+        with:
+          app_id: ${{ secrets.ORG_READ_ONLY_APP_ID }}
+          private_key: ${{ secrets.ORG_READ_ONLY_APP_PRIVATE_KEY }}
+
+      # Install the token so all ssh pulls are rewritten to use the token from the previous step.
+      - name: setup git credentials
+        uses: de-vri-es/setup-git-credentials@v2
+        with:
+          credentials: https://x-access-token:${{ steps.org-read-only.outputs.token }}@github.com/
+
+      - name: Rust Toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: ${{ matrix.rust }}
+          override: true
+          profile: minimal
+
+      - name: Cache
+        uses: Swatinem/rust-cache@dd05243424bd5c0e585e4b55eb2d7615cdd32f1f
+
+      - name: CI Setup
+        run: if [[ -f ci/setup.sh ]]; then ci/setup.sh; fi
+
+      - name: Build Workspace
+        run: cargo build --workspace
+
+      - name: Test Workspace
+        run: |
+          if test -f "Makefile"; then
+            make test
+          else
+            cargo test --workspace
+          fi