diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..b2b6721
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,63 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  checks:
+    name: Static checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Enable corepack
+        run: corepack enable
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Type check
+        run: pnpm exec tsc --noEmit
+
+      - name: Build
+        run: pnpm build
+
+  publish:
+    name: Build and push image
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # PACKAGE_TOKEN is provided by the runner environment, not a repo
+      # secret - it's already present in the job's shell environment.
+      - name: Log in to the Gitea container registry
+        run: echo "$PACKAGE_TOKEN" | docker login dev.pivoine.art -u ${{ github.repository_owner }} --password-stdin
+
+      - name: Build image
+        run: |
+          docker build \
+            -t dev.pivoine.art/${{ github.repository }}:latest \
+            -t dev.pivoine.art/${{ github.repository }}:${{ github.ref_name }} \
+            .
+
+      - name: Push image
+        run: |
+          docker push dev.pivoine.art/${{ github.repository }}:latest
+          docker push dev.pivoine.art/${{ github.repository }}:${{ github.ref_name }}
+
+      - name: Log out
+        if: always()
+        run: docker logout dev.pivoine.art