diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
new file mode 100644
index 0000000..5d45a8d
--- /dev/null
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,46 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # bluehound is macOS-only (CoreBluetooth/IOBluetooth + prebuilt macOS
+      # libsimpleble.a), and the only runner is linux, so this job validates
+      # sources rather than compiling the binary.
+
+      - name: Install tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y cppcheck shellcheck python3
+
+      - name: Check required files exist
+        run: |
+          set -e
+          for f in bluehound.cpp classic_bluetooth.mm classic_bluetooth.h \
+                   CMakeLists.txt build.sh serve_dashboard.py \
+                   web_dashboard.html third_party/httplib.h \
+                   simpleble/simpleble/build/lib/libsimpleble.a; do
+            [ -e "$f" ] || { echo "missing: $f"; exit 1; }
+          done
+          echo "all required files present"
+
+      - name: Validate Python
+        run: python3 -m py_compile serve_dashboard.py
+
+      # report-only: surfaces findings without gating an unformatted codebase
+      - name: Static analysis (report-only)
+        run: |
+          cppcheck --enable=warning,performance,portability --std=c++17 \
+            --suppress=missingIncludeSystem bluehound.cpp classic_bluetooth.h || true
+
+      - name: Lint shell scripts (report-only)
+        run: shellcheck build.sh || true