diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..f70ecd6
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,17 @@
+name: "Tests"
+on: [push, pull_request]
+jobs:
+    bats:
+        name: "BATS job"
+        runs-on: ubuntu-latest
+        steps:
+            - name: "Setup BATS testing framework"
+              uses: mig4/setup-bats@v1.0.1
+              with:
+                  bats-version: 1.1.0
+
+            - name: "Check out code"
+              uses: actions/checkout@v1
+
+            - name: "Run BATS tests"
+              run: bats -r tests
diff --git a/tests/0001.bats b/tests/0001.bats
new file mode 100644
index 0000000..5fe44ae
--- /dev/null
+++ b/tests/0001.bats
@@ -0,0 +1,183 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+    f test/.hiddenfile
+    f test/usr/bin/ping
+    f test/usr/bin/lost+found
+    f test/usr/src/linux-"$test_uname"/.config
+    f test/usr/src/linux-"$test_uname"/vmlinux
+    f test/lib/modules/"$test_uname"/mod.ko
+    f test/lib64/modules/"$test_uname"/mod.ko
+    f test/dev/sda
+    f test/proc/cpuinfo
+    f test/run/pid
+    d test/sys/fs
+    f test/tmp/junk
+    d test/media/cdrom
+    f test/mnt/1/content
+    f test/root/.bash_history
+    f test/home/user/.bash_history
+    f test/home/user/chroot/var/tmp/file
+    f test/boot/kernel
+    f test/var/tmp/file
+    f test/var/lock/lockfile
+    f test/var/run/pid
+    f test/var/lib/docker/image
+    f test/var/log/messages
+    f test/var/log/portage/elog/.keep_sys-apps_portage-0
+    mkstage4.sh -q -t test test
+}
+
+teardown() {
+    rm -rf test test.tar.bz2
+}
+
+@test "/usr/bin/ping is included" {
+    assert_tar_includes test/usr/bin/ping
+}
+
+@test "/usr/bin/lost+found is included" {
+    assert_tar_includes test/usr/bin/lost+found
+}
+
+@test "/usr/src/linux-uname/.config is included" {
+    assert_tar_includes test/usr/src/linux-"$test_uname"/.config
+}
+
+@test "/usr/src/linux-uname/vmlinux is included" {
+    assert_tar_includes test/usr/src/linux-"$test_uname"/vmlinux
+}
+
+@test "/lib/modules/uname/mod.ko is included" {
+    assert_tar_includes test/lib/modules/"$test_uname"/mod.ko
+}
+
+@test "/lib64/modules/uname/mod.ko is included" {
+    assert_tar_includes test/lib64/modules/"$test_uname"/mod.ko
+}
+
+@test "/dev/* is excluded" {
+    assert_tar_excludes test/dev/sda
+}
+
+@test "/var/tmp/* is excluded" {
+    assert_tar_excludes test/var/tmp/file
+}
+
+@test "/media/* is excluded" {
+    assert_tar_excludes test/media/cdrom
+}
+
+@test "/mnt/* is excluded" {
+    assert_tar_excludes test/mnt/1
+}
+
+@test "/proc/* is excluded" {
+    assert_tar_excludes test/proc/cpuinfo
+}
+
+@test "/run/* is excluded" {
+    assert_tar_excludes test/run/pid
+}
+
+@test "/sys/* is excluded" {
+    assert_tar_excludes test/sys/fs
+}
+
+@test "/tmp/* is excluded" {
+    assert_tar_excludes test/tmp/junk
+}
+
+@test "/var/lock/* is excluded" {
+    assert_tar_excludes test/var/lock/lockfile
+}
+
+@test "/var/log/* is excluded" {
+    assert_tar_excludes test/var/log/messages
+}
+
+@test "/var/run/* is excluded" {
+    assert_tar_excludes test/var/run/pid
+}
+
+@test "/var/lib/docker/* is excluded" {
+    assert_tar_excludes test/var/lib/docker/image
+}
+
+@test "/dev/ is included" {
+    assert_tar_includes test/dev/
+}
+
+@test "/var/tmp/ is included" {
+    assert_tar_includes test/var/tmp/
+}
+
+@test "/media/ is included" {
+    assert_tar_includes test/media/
+}
+
+@test "/mnt/ is included" {
+    assert_tar_includes test/mnt/
+}
+
+@test "/proc/ is included" {
+    assert_tar_includes test/proc/
+}
+
+@test "/run/ is included" {
+    assert_tar_includes test/run/
+}
+
+@test "/sys/ is included" {
+    assert_tar_includes test/sys/
+}
+
+@test "/tmp/ is included" {
+    assert_tar_includes test/tmp/
+}
+
+@test "/var/lock/ is included" {
+    assert_tar_includes test/var/lock/
+}
+
+@test "/var/log/ is included" {
+    assert_tar_includes test/var/log/
+}
+
+@test "/var/run/ is included" {
+    assert_tar_includes test/var/run/
+}
+
+@test "/var/lib/docker/ is included" {
+    assert_tar_includes test/var/lib/docker/
+}
+
+@test "/boot/kernel is included" {
+    assert_tar_includes test/boot/kernel
+}
+
+@test "/.hiddenfile is included" {
+    skip "TODO: Not yet implemented"
+    assert_tar_includes test/.hiddenfile
+}
+
+@test "/var/log/**/.keep is included" {
+    skip "TODO: Not yet implemented"
+    assert_tar_includes test/var/log/portage/elog/.keep_sys-apps_portage-0
+}
+
+@test "/home/user/.bash_history is excluded" {
+    assert_tar_excludes test/home/user/.bash_history
+}
+
+@test "/root/.bash_history is included" {
+    assert_tar_includes test/root/.bash_history
+}
+
+@test "/home/user/chroot/var/tmp/file is included" {
+    assert_tar_includes test/home/user/chroot/var/tmp/file
+}
+
+# vim: ft=bash
diff --git a/tests/0002.bats b/tests/0002.bats
new file mode 100644
index 0000000..95d2c4e
--- /dev/null
+++ b/tests/0002.bats
@@ -0,0 +1,28 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+    f test/usr/bin/ping
+    f test/usr/bin/lost+found
+    f test/lost+found
+    mkstage4.sh -q -l -t test test
+}
+
+teardown() {
+    rm -rf test test.tar.bz2
+}
+
+@test "/usr/bin/ping is included" {
+    assert_tar_includes test/usr/bin/ping
+}
+
+@test "/usr/bin/lost+found is excluded" {
+    assert_tar_excludes test/usr/bin/lost+found
+}
+
+@test "/lost+found is excluded" {
+    assert_tar_excludes test/lost+found
+}
+
+# vim: ft=bash
diff --git a/tests/0003.bats b/tests/0003.bats
new file mode 100644
index 0000000..ba7cfe0
--- /dev/null
+++ b/tests/0003.bats
@@ -0,0 +1,54 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+    f test/usr/bin/ping
+    f test/usr/src/linux-"$test_uname"/.config
+    f test/usr/src/linux-"$test_uname"/vmlinux
+    f test/lib/modules/"$test_uname"/mod.ko
+    f test/lib64/modules/"$test_uname"/mod.ko
+    mkstage4.sh -k -q -t test test
+}
+
+teardown() {
+    rm -rf test test.tar.bz2 test.tar.bz2.ksrc test.tar.bz2.kmod
+}
+
+@test "/usr/bin/ping is included" {
+    assert_tar_includes test/usr/bin/ping
+}
+
+@test "/usr/src/linux-uname/.config is excluded" {
+    assert_tar_excludes test/usr/src/linux-"$test_uname"/.config
+}
+
+@test "/usr/src/linux-uname/vmlinux is excluded" {
+    assert_tar_excludes test/usr/src/linux-"$test_uname"/vmlinux
+}
+
+@test "/lib/modules/uname/mod.ko is excluded" {
+    assert_tar_excludes test/lib/modules/"$test_uname"/mod.ko
+}
+
+@test "/lib64/modules/uname/mod.ko is excluded" {
+    assert_tar_excludes test/lib64/modules/"$test_uname"/mod.ko
+}
+
+@test "/usr/src/linux-uname/.config is included" {
+    assert_tar_includes test/usr/src/linux-"$test_uname"/.config test.tar.bz2.ksrc
+}
+
+@test "/usr/src/linux-uname/vmlinux is included" {
+    assert_tar_includes test/usr/src/linux-"$test_uname"/vmlinux test.tar.bz2.ksrc
+}
+
+@test "/lib/modules/uname/mod.ko is included" {
+    assert_tar_includes test/lib/modules/"$test_uname"/mod.ko test.tar.bz2.kmod
+}
+
+@test "/lib64/modules/uname/mod.ko is included" {
+    assert_tar_includes test/lib64/modules/"$test_uname"/mod.ko test.tar.bz2.kmod
+}
+
+# vim: ft=bash
diff --git a/tests/0004.bats b/tests/0004.bats
new file mode 100644
index 0000000..cdd1ecf
--- /dev/null
+++ b/tests/0004.bats
@@ -0,0 +1,24 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+    f test/boot/kernel
+    d test/boot/boot
+    mkstage4.sh -b -q -t test test
+}
+
+teardown() {
+    rm -rf test test.tar.bz2
+}
+
+@test "/boot/kernel is excluded" {
+    assert_tar_excludes test/boot/kernel
+}
+
+@test "/boot/boot is included" {
+    skip "TODO: Not yet implemented"
+    assert_tar_includes test/boot/boot
+}
+
+# vim: ft=bash
diff --git a/tests/0005.bats b/tests/0005.bats
new file mode 100644
index 0000000..ee2e175
--- /dev/null
+++ b/tests/0005.bats
@@ -0,0 +1,22 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+    f test/var/lib/connman/file
+    mkstage4.sh -c -q -t test test
+}
+
+teardown() {
+    rm -rf test test.tar.bz2
+}
+
+@test "/var/lib/connman/file is excluded" {
+    assert_tar_excludes test/var/lib/connman/file
+}
+
+@test "/var/lib/connman/ is included" {
+    assert_tar_includes test/var/lib/connman/
+}
+
+# vim: ft=bash
diff --git a/tests/0006.bats b/tests/0006.bats
new file mode 100644
index 0000000..e752e3e
--- /dev/null
+++ b/tests/0006.bats
@@ -0,0 +1,40 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+    f test/var/db/repos/gentoo/app-backup/mkstage4/ebuild
+    f test/var/cache/distfiles/mkstage4.tar.gz
+    f test/usr/portage/Manifest
+    mkstage4.sh -q -t test test
+}
+
+teardown() {
+    rm -rf test test.tar.bz2
+}
+
+@test "/var/db/repos/gentoo/app-backup is excluded" {
+    assert_tar_excludes test/var/db/repos/gentoo/app-backup
+}
+
+@test "/var/db/repos/gentoo/ is included" {
+    assert_tar_includes test/var/db/repos/gentoo/
+}
+
+@test "/var/cache/distfiles/mkstage4.tar.gz is excluded" {
+    assert_tar_excludes test/var/cache/distfiles/mkstage4.tar.gz
+}
+
+@test "/var/cache/distfiles/ is included" {
+    assert_tar_includes test/var/cache/distfiles/
+}
+
+@test "/usr/portage/Manifest is excluded" {
+    assert_tar_excludes test/usr/portage/Manifest
+}
+
+@test "/usr/portage/ is included" {
+    assert_tar_includes test/usr/portage/
+}
+
+# vim: ft=bash
diff --git a/tests/0007.bats b/tests/0007.bats
new file mode 100644
index 0000000..0ca4b66
--- /dev/null
+++ b/tests/0007.bats
@@ -0,0 +1,62 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+setup() {
+    f test/usr/bin/lost+found
+    f test/lost+found
+    f test/home/user/.dotfile
+    f test/home/user/chroot/var/tmp/file
+    f test/home/user/ccache/file
+    f test/root/ccache/file
+    f test/etc/secrets/key
+    mkstage4.sh -q -t test test0
+    mkstage4.sh \
+        -e 'test/lost+found' \
+        -e 'user/.*' \
+        -e 'test/home/user/chroot/var/tmp/file' \
+        -e 'ccache/*' \
+        -e 'secrets' \
+        -q -t test test
+}
+
+teardown() {
+    rm -rf test test.tar.bz2 test0.tar.bz2
+}
+
+@test "-e '/lost+found'" {
+    assert_tar_includes test/usr/bin/lost+found test0.tar.bz2
+    assert_tar_includes test/usr/bin/lost+found
+
+    assert_tar_includes test/lost+found test0.tar.bz2
+    assert_tar_excludes test/lost+found
+}
+
+@test "-e 'user/.*'" {
+    assert_tar_includes test/home/user/.dotfile test0.tar.bz2
+    assert_tar_excludes test/home/user/.dotfile
+    assert_tar_includes test/home/user/
+}
+
+@test "-e 'test/home/user/chroot/var/tmp/file'" {
+    assert_tar_includes test/home/user/chroot/var/tmp/file test0.tar.bz2
+    assert_tar_excludes test/home/user/chroot/var/tmp/file
+}
+
+@test "-e 'ccache/*'" {
+    assert_tar_includes test/home/user/ccache/file test0.tar.bz2
+    assert_tar_excludes test/home/user/ccache/file
+    assert_tar_includes test/home/user/ccache/
+
+    assert_tar_includes test/root/ccache/file test0.tar.bz2
+    assert_tar_excludes test/root/ccache/file
+    assert_tar_includes test/root/ccache/
+}
+
+@test "-e 'secrets'" {
+    assert_tar_includes test/etc/secrets/key test0.tar.bz2
+    assert_tar_excludes test/etc/secrets/key
+    assert_tar_excludes test/etc/secrets/
+}
+
+# vim: ft=bash
diff --git a/tests/test_helper.bash b/tests/test_helper.bash
new file mode 100644
index 0000000..a375d3b
--- /dev/null
+++ b/tests/test_helper.bash
@@ -0,0 +1,44 @@
+#!/bin/bash
+
+test_directory="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+export PATH="$test_directory/..:$PATH"
+
+test_uname="test-uname"
+uname() { echo "$test_uname"; }
+export -f uname
+
+# bypasses mkstage4.sh root check
+whoami() { echo "root"; }
+export -f whoami
+
+skip_if_not_root() {
+    if [ "$EUID" -ne 0 ]; then
+        skip "Must be root for this test."
+    fi
+}
+
+d() {
+    mkdir -p "${1}"
+}
+
+f() {
+    mkdir -p "$(dirname "${1}")" && touch "${1}"
+}
+
+assert_tar_includes() {
+    test -f "${1}" || test -d "${1}"
+    tar --list -f "${2-test.tar.bz2}" | grep -q "^${1}$"
+}
+
+assert_tar_includes_partial() {
+    tar --list -f "${2-test.tar.bz2}" | grep -q "${1}"
+}
+
+assert_tar_excludes() {
+    test -f "${1}" || test -d "${1}"
+    ! tar --list -f "${2-test.tar.bz2}" | grep -q "^${1}$"
+}
+
+assert_tar_excludes_partial() {
+    ! tar --list -f "${2-test.tar.bz2}" | grep -q "${1}"
+}