diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 000000000..df73f3cfb
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,66 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 5 * * *" # nightly vuln rescan
+
+jobs:
+  modules:
+    name: ${{ matrix.module }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module:
+          - .
+          - api
+          - sdk
+          - plugins/boundary/mains/aws
+          - plugins/boundary/mains/azure
+          - plugins/boundary/mains/gcp
+          - plugins/boundary/mains/minio
+          - plugins/kms/mains/alicloudkms
+          - plugins/kms/mains/awskms
+          - plugins/kms/mains/azurekeyvault
+          - plugins/kms/mains/gcpckms
+          - plugins/kms/mains/ibmkp
+          - plugins/kms/mains/ocikms
+          - plugins/kms/mains/transit
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: .go-version
+          cache: false
+      - name: build
+        working-directory: ${{ matrix.module }}
+        run: go build ./...
+      - name: vet
+        working-directory: ${{ matrix.module }}
+        run: go vet ./...
+      - name: govulncheck
+        working-directory: ${{ matrix.module }}
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          "$(go env GOPATH)/bin/govulncheck" ./...
+      - name: unit tests (api, sdk only; root needs Postgres)
+        if: matrix.module == 'api' || matrix.module == 'sdk'
+        working-directory: ${{ matrix.module }}
+        run: go test ./...
+
+  osv:
+    name: osv-scanner
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: .go-version
+          cache: false
+      - run: |
+          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
+          "$(go env GOPATH)/bin/osv-scanner" scan source -r .