diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
new file mode 100644
index 0000000..adb5786
--- /dev/null
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,56 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  test-cli:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: https://github.com/astral-sh/setup-uv@v5
+        with:
+          python-version: "3.13"
+      - run: uv sync --all-packages
+      - run: uv run pytest tests/
+
+  test-sqlmesh:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: https://github.com/astral-sh/setup-uv@v5
+        with:
+          python-version: "3.13"
+      - run: uv sync --all-packages
+      - run: cd transform/sqlmesh_materia && uv run sqlmesh test
+
+  test-web:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: https://github.com/astral-sh/setup-uv@v5
+        with:
+          python-version: "3.13"
+      - run: uv sync --all-packages
+      - run: cd web && uv run pytest tests/ -x -q
+      - run: cd web && uv run ruff check src/ tests/
+
+  # Creates v<N> tag after all tests pass. The on-server supervisor polls for new
+  # tags every 60s and deploys automatically. No SSH keys or deploy credentials
+  # needed in CI — only the built-in github.token.
+  tag:
+    needs: [test-cli, test-sqlmesh, test-web]
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ github.token }}
+      - name: Create and push tag
+        run: |
+          git config user.name "CI"
+          git config user.email "ci@noreply"
+          git tag "v${{ github.run_number }}"
+          git push origin "v${{ github.run_number }}"