diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..50d3e03
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,42 @@
+name: build
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build & push muyu services
+        run: |
+          set -eo pipefail
+          REG=localhost:3000/kaezhou
+          BR=docker.io/library                       # muyu Dockerfile: FROM ${BASE_REGISTRY}/img
+          TAG=dev-$(echo "${{ github.sha }}" | cut -c1-8)
+
+          # host 模式无 Node，用 git clone 代替 actions/checkout
+          workdir=$(mktemp -d)
+          git clone "http://kaezhou:${{ secrets.REGISTRY_TOKEN }}@localhost:3000/kaezhou/muyu-apiserver.git" "$workdir"
+          cd "$workdir"
+          git checkout "${{ github.sha }}"
+
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login localhost:3000 -u kaezhou --password-stdin
+
+          for pair in \
+            "muyu-gateway:deploy/Dockerfile.gateway" \
+            "muyu-system-rpc:deploy/Dockerfile.system" \
+            "muyu-inventory-rpc:deploy/Dockerfile.inventory" \
+            "muyu-purchase-rpc:deploy/Dockerfile.purchase" \
+            "muyu-production-rpc:deploy/Dockerfile.production"; do
+            name="${pair%%:*}"; df="${pair##*:}"
+            echo "::group::build $name ($df)"
+            docker build --build-arg BASE_REGISTRY="$BR" -f "$df" \
+              -t "$REG/$name:$TAG" -t "$REG/$name:latest" .
+            docker push "$REG/$name:$TAG"
+            docker push "$REG/$name:latest"
+            echo "::endgroup::"
+          done
+
+          rm -rf "$workdir"
+          echo "done: pushed 5 muyu images at tag $TAG + latest"