@@ -0,0 +1,47 @@
+name: ci
+
+on:
+   push:
+      branches:
+         - "**"
+
+jobs:
+   build:
+      name: build (${{ matrix.platform }})
+      runs-on: ${{ matrix.runner }}
+      permissions:
+         contents: read
+      strategy:
+         fail-fast: false
+         matrix:
+            include:
+               - platform: linux/amd64
+                 runner: ubuntu-latest
+               - platform: linux/arm64
+                 runner: ubuntu-24.04-arm
+
+      steps:
+         - name: Checkout
+           uses: actions/checkout@v7.0.1
+
+         - name: Set up Docker Buildx
+           uses: docker/setup-buildx-action@v4.2.0
+
+         # dhi.io is gated: the builder pulls dhi.io/alpine-base:*-dev and
+         # the runtime stage pulls dhi.io/alpine-base:3.23.
+         - name: Login to Docker Hub (for dhi.io)
+           uses: docker/login-action@v4.5.1
+           with:
+              registry: dhi.io
+              username: ${{ secrets.DOCKERHUB_USERNAME }}
+              password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+         - name: Build image (no push)
+           uses: docker/build-push-action@v7.3.2
+           with:
+              context: .
+              file: .docker/Dockerfile
+              platforms: ${{ matrix.platform }}
+              cache-from: type=gha,scope=${{ matrix.platform }}
+              cache-to: type=gha,scope=${{ matrix.platform }},mode=max
+              push: false