diff --git a/.github/workflows/blank.yml b/.github/workflows/blank.yml
index 0160ff3..30ff3da 100644
--- a/.github/workflows/blank.yml
+++ b/.github/workflows/blank.yml
@@ -1,36 +1,44 @@
-# This is a basic workflow to help you get started with Actions
-
 name: CI
 
-# Controls when the workflow will run
 on:
-  # Triggers the workflow on push or pull request events but only for the "develop" branch
   push:
-    branches: [ "develop" ]
+    branches:
+      - develop
+
   pull_request:
-    branches: [ "develop" ]
+    branches:
+      - develop
+      - main
 
-  # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "build"
-  build:
-    # The type of runner that the job will run on
+  test_frontend:
     runs-on: ubuntu-latest
 
-    # Steps represent a sequence of tasks that will be executed as part of the job
+    defaults:
+      run:
+        working-directory: ./frontend/indiestream
+
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
-
-      # Runs a single command using the runners shell
-      - name: Run a one-line script
-        run: echo Hello, world!
-
-      # Runs a set of commands using the runners shell
-      - name: Run a multi-line script
-        run: |
-          echo Add other actions to build,
-          echo test, and deploy your project.
+      - uses: actions/checkout@v4
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          # needed because project is not in root
+          cache-dependency-path: ./frontend/indiestream/package-lock.json
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm run ci:install
+
+      - name: Audit dependencies
+        run: npm run ci:audit
+
+      - name: Build
+        run: npm run build
+
+      # no tests yet
+      #- name: Test
+      #  run: npm run test
diff --git a/frontend/indiestream/package-lock.json b/frontend/indiestream/package-lock.json
index ae17d0a..ddeb56c 100644
--- a/frontend/indiestream/package-lock.json
+++ b/frontend/indiestream/package-lock.json
@@ -25,6 +25,7 @@
         "@angular/cli": "^17.3.3",
         "@angular/compiler-cli": "^17.3.0",
         "@types/jasmine": "~5.1.0",
+        "@types/node": "^20.11.17",
         "jasmine-core": "~5.1.0",
         "karma": "~6.4.0",
         "karma-chrome-launcher": "~3.2.0",
diff --git a/frontend/indiestream/package.json b/frontend/indiestream/package.json
index 7ade5e0..0249fc5 100644
--- a/frontend/indiestream/package.json
+++ b/frontend/indiestream/package.json
@@ -4,9 +4,11 @@
   "scripts": {
     "ng": "ng",
     "start": "ng serve",
-    "build": "ng build",
+    "build": "ng build indiestream",
     "watch": "ng build --watch --configuration development",
-    "test": "ng test"
+    "test": "ng test indiestream",
+    "ci:audit": "npm audit --audit-level high",
+    "ci:install": "npm ci"
   },
   "private": true,
   "dependencies": {
@@ -27,6 +29,7 @@
     "@angular/cli": "^17.3.3",
     "@angular/compiler-cli": "^17.3.0",
     "@types/jasmine": "~5.1.0",
+    "@types/node": "^20.11.17",
     "jasmine-core": "~5.1.0",
     "karma": "~6.4.0",
     "karma-chrome-launcher": "~3.2.0",