diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..6356efe
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,32 @@
+# 复制到 itfx-front 仓库 .gitea/workflows/deploy.yml
+# 前置: kaniko-git + kaniko-docker-config；act_runner(k3s-host) 只负责 kubectl
+# 构建在集群 Kaniko Job（role=build），不跑宿主机 Docker
+name: Build and Deploy Front
+
+on:
+  push:
+    branches: [master, main]
+  workflow_dispatch:
+
+env:
+  IMAGE_NAME: itfx-front
+  TCR_REGISTRY: ccr.ccs.tencentyun.com
+  TCR_NAMESPACE: ideship
+
+jobs:
+  deploy:
+    runs-on: k3s-host
+    steps:
+      - name: Build and deploy
+        run: |
+          set -euxo pipefail
+          export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+          TAG="${{ gitea.sha }}"
+          IMG="${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${TAG}"
+          REPO="${{ gitea.repository }}"
+          REPO="${REPO:-${{ github.repository }}}"
+          test -n "$REPO" && [[ "$REPO" == */* ]]
+          echo "REPO=$REPO TAG=$TAG host=$(hostname)"
+          cd /data/k3s
+          ./scripts/ci-publish-front.sh "$REPO" "${{ env.IMAGE_NAME }}" "$TAG" "$TAG"
+          ./scripts/ci-deploy-front.sh "$IMG"