diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..9af549d
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,25 @@
+name: build
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build & push muyu-portal
+        run: |
+          set -eo pipefail
+          REG=localhost:3000/kaezhou
+          TAG=dev-$(echo "${{ github.sha }}" | cut -c1-8)
+          workdir=$(mktemp -d)
+          git clone "http://kaezhou:${{ secrets.REGISTRY_TOKEN }}@localhost:3000/kaezhou/muyu-portal.git" "$workdir"
+          cd "$workdir"; git checkout "${{ github.sha }}"
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login localhost:3000 -u kaezhou --password-stdin
+          docker build --build-arg BASE_REGISTRY=docker.io/library \
+            -t "$REG/muyu-portal:$TAG" -t "$REG/muyu-portal:latest" .
+          docker push "$REG/muyu-portal:$TAG"
+          docker push "$REG/muyu-portal:latest"
+          rm -rf "$workdir"
+          echo "done: muyu-portal pushed at $TAG + latest"