diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..a8b2fb9
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,22 @@
+name: Tests
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: python -m unittest discover -s tests -v
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index 0c99541..d929185 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -34,6 +34,14 @@ The workflow uses [npm trusted publishing](https://docs.npmjs.com/trusted-publis
 `devin-cli`, workflow `publish-npm.yml` (no environment) as its trusted
 publisher.
 
+## Tests
+
+With Python and npm on `PATH`, run the packaging tests without publishing:
+
+```sh
+python -m unittest discover -s tests -v
+```
+
 ## GitHub releases
 
 `scripts/release_from_manifest.py` (run hourly by
diff --git a/scripts/publish_npm.py b/scripts/publish_npm.py
index 520579b..d947df2 100644
--- a/scripts/publish_npm.py
+++ b/scripts/publish_npm.py
@@ -186,7 +186,7 @@ def build_launcher_package(version: str, out: Path) -> Path:
 
 
 def npm(args: list[str], cwd: Path) -> None:
-    subprocess.run(["npm", *args], cwd=cwd, check=True)
+    subprocess.run([shutil.which("npm") or "npm", *args], cwd=cwd, check=True)
 
 
 def release(pkg_dir: Path, tag: str, registry: str, publish: bool, provenance: bool) -> None:
diff --git a/tests/test_publish_npm.py b/tests/test_publish_npm.py
new file mode 100644
index 0000000..6d9d673
--- /dev/null
+++ b/tests/test_publish_npm.py
@@ -0,0 +1,29 @@
+import json
+import tarfile
+import tempfile
+import unittest
+from pathlib import Path
+
+from scripts.publish_npm import release
+
+
+class NpmPackagingTests(unittest.TestCase):
+    def test_pack_from_directory_with_spaces(self):
+        with tempfile.TemporaryDirectory(prefix="devin npm test ") as tmp:
+            out = Path(tmp)
+            pkg_dir = out / "launcher package"
+            pkg_dir.mkdir()
+            package = {"name": "devin-pack-test", "version": "1.0.0", "private": True}
+            (pkg_dir / "package.json").write_text(json.dumps(package), encoding="utf-8")
+
+            release(pkg_dir, "latest", "https://registry.npmjs.org/", publish=False, provenance=False)
+
+            archive = out / "devin-pack-test-1.0.0.tgz"
+            self.assertTrue(archive.is_file())
+            with tarfile.open(archive) as tf:
+                with tf.extractfile("package/package.json") as metadata:
+                    self.assertEqual(json.load(metadata), package)
+
+
+if __name__ == "__main__":
+    unittest.main()