diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..a6faf46
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,92 @@
+# CI 管道 — moziplus v2.0
+#
+# 触发条件：
+#   - push（非 main 分支）
+#   - pull_request（opened, synchronize）
+#
+# Gitea v1.23.4 限制注意：
+#   - 不支持 failure() 表达式，用 always() + shell 条件判断替代
+#   - 不支持 concurrency / continue-on-error / timeout-minutes / permissions
+#   - 无内置 GITEA_TOKEN，需手动配置 PAT 为 secret
+#   - runs-on 只支持单个 label
+
+name: CI
+
+on:
+  push:
+    branches:
+      - '**'
+      - '!main'
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  # ── Job 1: Lint ──────────────────────────────────────
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        run: |
+          python3 -m venv .venv
+          .venv/bin/pip install --quiet flake8
+
+      - name: Lint with flake8
+        run: |
+          .venv/bin/flake8 src/ --max-line-length=120 --extend-ignore=E501
+
+  # ── Job 2: Test ──────────────────────────────────────
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        run: |
+          python3 -m venv .venv
+          .venv/bin/pip install --quiet -r requirements.txt
+
+      - name: Run tests (exclude E2E)
+        run: |
+          .venv/bin/pytest tests/ -m "not e2e" -x -q
+
+  # ── Job 3: CI 失败通知 ───────────────────────────────
+  # v1.23 不支持 failure()，用 always() + shell 检查 commit status 替代
+  notify-on-failure:
+    runs-on: ubuntu-latest
+    needs: [lint, test]
+    if: always()
+    steps:
+      - name: Check results and notify
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          # 查询当前 commit 的 status
+          STATUS=$(curl -sf \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "${{ gitea.api_url }}/repos/${{ gitea.repository }}/commits/${{ gitea.sha }}/status" \
+            | python3 -c "import sys,json; print(json.load(sys.stdin).get('state',''))" 2>/dev/null || echo "")
+
+          echo "Commit status: $STATUS"
+
+          if [ "$STATUS" != "success" ]; then
+            echo "CI failed or status unknown, sending notification..."
+
+            # 如果是 PR 事件，写评论通知
+            PR_NUMBER="${{ gitea.event.pull_request.number }}"
+            if [ -n "$PR_NUMBER" ]; then
+              curl -sf -X POST \
+                -H "Authorization: token $GITEA_TOKEN" \
+                -H "Content-Type: application/json" \
+                "${{ gitea.api_url }}/repos/${{ gitea.repository }}/issues/${PR_NUMBER}/comments" \
+                -d "{\"body\": \"❌ **CI 失败**\\n\\n请检查 CI 日志并修复。\\n\\n触发 commit: \`${{ gitea.sha }}\`\"}" \
+                || echo "Failed to post PR comment"
+              echo "PR comment posted."
+            else
+              echo "Not a PR event, skipping PR comment."
+            fi
+          else
+            echo "CI passed, no notification needed."
+          fi