diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
new file mode 100644
index 0000000..9673afc
--- /dev/null
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,95 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE: forgejo.riotpiao.com/rock/kmsvc-cli
+
+jobs:
+  test:
+    name: Test
+    runs-on: golang
+    steps:
+      - name: Install Node.js for actions runtime
+        run: apt-get update && apt-get install -y nodejs
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Configure git auth for private modules
+        run: |
+          git config --global url."https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+
+      - name: gofmt
+        run: |
+          fmt_out="$(gofmt -l ./cmd ./internal)"
+          if [ -n "$fmt_out" ]; then
+            echo "$fmt_out"
+            echo "::error::gofmt found unformatted files"
+            exit 1
+          fi
+
+      - name: go vet
+        run: go vet ./cmd/... ./internal/...
+
+      - name: go build
+        run: go build ./cmd/kmsvc
+
+      - name: go test
+        run: go test ./cmd/... ./internal/... -race
+
+  build-push:
+    name: Build & Push Binaries
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: golang
+    steps:
+      - name: Install Node.js
+        run: apt-get update && apt-get install -y nodejs
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Configure git auth
+        run: |
+          git config --global url."https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+
+      - name: Get short SHA
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Build cross-platform binaries
+        run: |
+          mkdir -p dist
+          VERSION="${{ steps.sha.outputs.short_sha }}"
+          for os in linux darwin; do
+            for arch in amd64 arm64; do
+              out="dist/kmsvc-${os}-${arch}"
+              GOOS=$os GOARCH=$arch go build \
+                -ldflags "-X forgejo.riotpiao.com/riotpiao-poimen/kmsvc-cli/internal/cli.version=${VERSION}" \
+                -o "${out}" ./cmd/kmsvc
+            done
+          done
+          ls -lh dist/
+
+      - name: Create archive
+        run: |
+          cd dist
+          tar czf kmsvc-${{ steps.sha.outputs.short_sha }}.tar.gz kmsvc-*
+          ls -lh kmsvc-*.tar.gz
+
+      - name: Publish release
+        run: |
+          echo "✓ Binaries ready at dist/"
+          echo "  Tag release: git tag v0.x.x && git push --tags"