diff --git a/.gitea/workflows/actions.yaml b/.gitea/workflows/actions.yaml
new file mode 100644
index 0000000..3796a9c
--- /dev/null
+++ b/.gitea/workflows/actions.yaml
@@ -0,0 +1,90 @@
+name: Container
+on: [push]
+
+jobs:
+  semrel_dryrun:
+    name: Semantic Release (Dry-run)
+    runs-on: dind-rootless
+    outputs:
+      version: ${{ steps.sem_rel.outputs.version }}
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: 20
+      - name: Install dependencies
+        run: |
+          npm install \
+            semantic-release \
+            @semantic-release/commit-analyzer \
+            @semantic-release/exec
+      - name: Semantic Release (dry-run)
+        id: sem_rel
+        run: |
+          npx semantic-release \
+            --package @semantic-release/exec \
+            --package semantic-release \
+            --branches ${{ gitea.refname }} \
+            --tag-format 'v${version}' \
+            --dry-run \
+            --plugins @semantic-release/commit-analyzer,@semantic-release/exec \
+            --analyzeCommits @semantic-release/commit-analyzer \
+            --verifyRelease @semantic-release/exec \
+            --verifyReleaseCmd 'echo "version=${nextRelease.version}" >> $GITHUB_OUTPUT'
+        env:
+          GIT_CREDENTIALS: ${{ secrets.GIT_USERNAME }}:${{ secrets.GIT_APIKEY }}
+      - name: Assert semantic release output
+        run: |
+          [[ -z "${{ steps.sem_rel.outputs.version }}" ]] && {
+            echo 'No release tag - exiting'; exit 1
+          } || {
+            echo 'Release tag set correctly: ${{ steps.sem_rel.outputs.version }}'; exit 0
+          }
+
+  build_container:
+    name: Container image
+    container: catthehacker/ubuntu:act-latest
+    runs-on: dind
+    needs: semrel_dryrun
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Kaniko build
+        uses: aevea/action-kaniko@master
+        with:
+          # extra_args: -v debug
+          registry: code.spamasaurus.com
+          image: djpbessems/packer-extended
+          username: ${{ secrets.GIT_USERNAME }}
+          password: ${{ secrets.GIT_APIKEY }}
+          tag: ${{ needs.semrel_dryrun.outputs.version }}
+
+  semrel:
+    name: Semantic Release
+    runs-on: dind-rootless
+    needs: [build_container, build_chart]
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: 20
+      - name: Install dependencies
+        run: |
+          npm install \
+            semantic-release \
+            @semantic-release/changelog \
+            @semantic-release/commit-analyzer \
+            @semantic-release/git \
+            @semantic-release/release-notes-generator
+      - name: Semantic Release
+        run: |
+          npx semantic-release \
+            --branches ${{ gitea.refname }} \
+            --tag-format 'v${version}' \
+            --plugins @semantic-release/commit-analyzer,@semantic-release/release-notes-generator,@semantic-release/changelog,@semantic-release/git
+        env:
+          GIT_CREDENTIALS: ${{ secrets.GIT_USERNAME }}:${{ secrets.GIT_APIKEY }}