diff --git a/.forgejo/workflows/ci-and-deploy.yaml b/.forgejo/workflows/ci-and-deploy.yaml
new file mode 100644
index 0000000..4d02fb5
--- /dev/null
+++ b/.forgejo/workflows/ci-and-deploy.yaml
@@ -0,0 +1,98 @@
+# ════════════════════════════════════════════════════
+# 光湖 · CI检查 + 合并后自动部署
+# ────────────────────────────────────────────────────
+# main分支: 冰朔合并PR后 → 自动部署到服务器
+# dev分支:  铸渊自己push → 只跑检查不部署
+# PR到main: 跑检查 → 冰朔看绿✅红❌再决定合不合
+# ════════════════════════════════════════════════════
+name: CI检查 + 自动部署
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main, dev]
+
+jobs:
+  # ── 所有情况都跑：基础检查 ──────────────────────
+  check:
+    runs-on: ubuntu
+    steps:
+      - name: 服务健康检查
+        run: |
+          echo "═══ 服务健康检查 ═══"
+          FAIL=0
+
+          if systemctl is-active --quiet nginx; then
+            echo "✅ Nginx"
+          else
+            echo "❌ Nginx 宕机"
+            FAIL=1
+          fi
+
+          if curl -sf http://127.0.0.1:3001/ > /dev/null 2>&1; then
+            echo "✅ Forgejo"
+          else
+            echo "❌ Forgejo 未响应"
+            FAIL=1
+          fi
+
+          if systemctl is-active --quiet gitea-runner; then
+            echo "✅ Runner"
+          else
+            echo "⚠️  Runner 未运行"
+          fi
+
+          if [ $FAIL -eq 1 ]; then
+            echo "❌ 关键服务异常"
+            exit 1
+          fi
+
+          echo "═══ 检查通过 ✅ ═══"
+
+      - name: 代码检查
+        run: |
+          cd /data/guanghulab/repo
+          echo "仓库大小: $(du -sh .git | cut -f1)"
+          echo "最新提交: $(git log --oneline -1)"
+          echo "✅ 代码检查完成"
+
+  # ── 只有合并到main才跑：自动部署 ────────────────
+  deploy:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: check
+    runs-on: ubuntu
+    steps:
+      - name: 同步最新代码
+        run: |
+          cd /data/guanghulab/repo
+          git fetch origin
+          git reset --hard origin/main
+          echo "✅ 代码已同步"
+
+      - name: 安装依赖
+        run: |
+          if [ -f /data/guanghulab/repo/server/secrets-vault/package.json ]; then
+            cd /data/guanghulab/repo/server/secrets-vault
+            npm install --production 2>/dev/null || true
+            echo "✅ 依赖已安装"
+          fi
+
+      - name: 重启服务
+        run: |
+          echo "═══ 重启服务 ═══"
+          if command -v pm2 &>/dev/null; then
+            pm2 restart all 2>/dev/null || true
+            echo "✅ 服务已重启"
+          fi
+          echo "═══ 重启完成 ═══"
+
+      - name: 部署验证
+        run: |
+          sleep 3
+          if curl -sf http://127.0.0.1:3001/ > /dev/null 2>&1; then
+            echo "✅ Forgejo 正常"
+          else
+            echo "⚠️  Forgejo 异常"
+          fi
+          echo "═══ 部署完成 ✅ $(date '+%Y-%m-%d %H:%M:%S') ═══"