diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
new file mode 100644
index 00000000..ef155c5d
--- /dev/null
+++ b/.github/workflows/pr.yml
@@ -0,0 +1,38 @@
+name: PR checks
+
+# Runs build.yml's "Eslint" job on every pull request, so a PR shows the
+# result before it merges (OpenConceptLab/ocl_issues#2838). Keep these steps
+# the same as that job's.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  eslint:
+    name: Eslint
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Fail if start-prod.sh writes a secret-shaped variable into env-config.js
+      run: |
+        ALLOWLIST="RECAPTCHA_SITE_KEY|ERRBIT_KEY"
+        LEAKS=$(grep -oE 'var [A-Za-z_]+' start-prod.sh | awk '{print $2}' | grep -E 'SECRET|PASSWORD|_KEY' | grep -vE "^(${ALLOWLIST})$" || true)
+        if [ -n "$LEAKS" ]; then
+          echo "::error::start-prod.sh writes secret-shaped variable(s) into the publicly-served env-config.js: $LEAKS"
+          echo "If this is intentionally public (like a DSN-style key), add it to ALLOWLIST above. Otherwise remove it."
+          exit 1
+        fi
+    - name: Run linting rules
+      uses: actions/setup-node@v3
+      with:
+        node-version: 14
+        cache: 'npm'
+    - run: npm ci
+    - run: ./node_modules/eslint/bin/eslint.js --ext .jsx,.js src/
diff --git a/package.json b/package.json
index 12c2ad91..baf1b539 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
   "scripts": {
     "start": "./node_modules/webpack-dev-server/bin/webpack-dev-server.js --progress --host 0.0.0.0 --port ${WEB_PORT} --env.API_URL=${API_URL} --env.NODE_ENV=${NODE_ENV} --env.RECAPTCHA_SITE_KEY=${RECAPTCHA_SITE_KEY} --env.GA_ACCOUNT_ID=${GA_ACCOUNT_ID} --env.HOTJAR_ID=${HOTJAR_ID} --env.ERRBIT_URL=${ERRBIT_URL} --env.ERRBIT_KEY=${ERRBIT_KEY} --env.LOGIN_REDIRECT_URL=${LOGIN_REDIRECT_URL} --env.OIDC_RP_CLIENT_ID=${OIDC_RP_CLIENT_ID} --mode ${NODE_ENV} --hot",
     "build": "node --max-old-space-size=1536 ./node_modules/webpack/bin/webpack.js --progress --host 0.0.0.0 --port 443 --env.API_URL=${API_URL} --env.NODE_ENV=${NODE_ENV} --env.RECAPTCHA_SITE_KEY=${RECAPTCHA_SITE_KEY} --env.GA_ACCOUNT_ID=${GA_ACCOUNT_ID} --env.HOTJAR_ID=${HOTJAR_ID} --env.ERRBIT_URL=${ERRBIT_URL} --env.ERRBIT_KEY=${ERRBIT_KEY} --env.LOGIN_REDIRECT_URL=${LOGIN_REDIRECT_URL} --env.OIDC_RP_CLIENT_ID=${OIDC_RP_CLIENT_ID} --mode ${NODE_ENV}",
-    "eslint": "./node_modules/.bin/eslint ./src"
+    "eslint": "./node_modules/.bin/eslint ./src --ext .jsx,.js"
   },
   "devDependencies": {
     "@babel/core": "^7.29.7",