diff --git a/.gitea/build.yaml b/.gitea/build.yaml
new file mode 100644
index 0000000..3d94ed5
--- /dev/null
+++ b/.gitea/build.yaml
@@ -0,0 +1,115 @@
+name: images-build-and-push
+
+on:
+  push:
+    branches: [ "main" ]
+
+env:
+  REGISTRY: ${{ secrets.REGISTRY }}
+  REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+
+jobs:
+  build:
+    runs-on: docker
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: debian
+            context: dockerfiles
+            dockerfile: dockerfiles/debian.dockerfile
+            watch: |
+              dockerfiles/debian.dockerfile
+            image: |
+              xdu/debian:latest
+              xdu/debian:trixie
+
+          - name: debian-12
+            context: dockerfiles
+            dockerfile: dockerfiles/debian-12.dockerfile
+            watch: |
+              dockerfiles/debian-12.dockerfile
+            image:
+              xdu/debian:bookworm
+
+          - name: ubuntu
+            context: dockerfiles
+            dockerfile: dockerfiles/ubuntu.dockerfile
+            watch: |
+              dockerfiles/ubuntu.dockerfile
+            image:
+              xdu/ubuntu:latest
+              xdu/ubuntu:25.10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Decide base commit
+        id: base
+        shell: bash
+        run: |
+          BASE="$(git rev-parse HEAD^ 2>/dev/null || true)"
+          if [ -z "$BASE" ]; then BASE="$(git rev-list --max-parents=0 HEAD)"; fi
+          echo "base=$BASE" >> $GITHUB_OUTPUT
+
+      - name: Check if changed
+        id: changed
+        shell: bash
+        run: |
+          CHANGED=false
+          while IFS= read -r p; do
+            [ -z "$p" ] && continue
+            if git diff --name-only "${{ steps.base.outputs.base }}"...HEAD -- "$p" | grep -q .; then
+              CHANGED=true; break
+            fi
+          done <<< "${{ matrix.watch }}"
+          echo "changed=$CHANGED" >> $GITHUB_OUTPUT
+
+      - name: Login to registry
+        if: steps.changed.outputs.changed == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ env.REGISTRY_USER }}
+          password: ${{ env.REGISTRY_PASSWORD }}
+
+      - name: Prepare tags & cache repo
+        if: steps.changed.outputs.changed == 'true'
+        id: meta
+        shell: bash
+        run: |
+          # 将 matrix.image 多行转为带 REGISTRY 前缀的完整 tags
+          FULL_TAGS=""
+          FIRST_REPO=""
+          while IFS= read -r line; do
+            [ -z "$line" ] && continue
+            TAG="${{ env.REGISTRY }}/$line"
+            FULL_TAGS="${FULL_TAGS}${TAG}"$'\n'
+            if [ -z "$FIRST_REPO" ]; then
+              FIRST_REPO="${{ env.REGISTRY }}/$(echo "$line" | cut -d: -f1)"
+            fi
+          done <<< "${{ matrix.image }}"
+
+          {
+            echo "tags<<__TAGS__"
+            printf "%s" "$FULL_TAGS"
+            echo "__TAGS__"
+            echo "cache_repo=$FIRST_REPO"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Build & Push
+        if: steps.changed.outputs.changed == 'true'
+        uses: docker/build-push-action@v5
+        with:
+          context: ${{ matrix.context }}
+          file: ${{ matrix.dockerfile }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=registry,ref=${{ steps.meta.outputs.cache_repo }}:buildcache
+          cache-to: type=registry,ref=${{ steps.meta.outputs.cache_repo }}:buildcache,mode=max
+
+      - name: Skip (no changes)
+        if: steps.changed.outputs.changed != 'true'
+        run: echo "No changes in watch list for ${{ matrix.name }}, skipping."
\ No newline at end of file