diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
new file mode 100644
index 00000000..2466ba3a
--- /dev/null
+++ b/.gitea/workflows/docker.yml
@@ -0,0 +1,74 @@
+---
+name: Build and publish Docker images
+
+"on":
+  push:
+    branches: [main]
+    tags: ["v*.*.*"]
+  workflow_dispatch:
+
+env:
+  REGISTRY: git.ipao.vip
+  GOCHAT_IMAGE: git.ipao.vip/${{ github.repository }}
+  SHANGWUTONG_IMAGE: git.ipao.vip/${{ github.repository_owner }}/shangwutong
+
+jobs:
+  docker:
+    name: Build and publish images
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Log in to Gitea container registry
+        env:
+          REGISTRY: ${{ env.REGISTRY }}
+          REGISTRY_USERNAME: ${{ github.repository_owner }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          test -n "$REGISTRY_TOKEN"
+          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" \
+            --username "$REGISTRY_USERNAME" --password-stdin
+
+      - name: Build and push images
+        env:
+          GOCHAT_IMAGE: ${{ env.GOCHAT_IMAGE }}
+          SHANGWUTONG_IMAGE: ${{ env.SHANGWUTONG_IMAGE }}
+          GITHUB_SHA: ${{ github.sha }}
+          GITHUB_REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -eu
+          version="${GITHUB_REF_NAME#v}"
+          if [ "$version" = "$GITHUB_REF_NAME" ]; then
+            version="dev-${GITHUB_SHA::12}"
+          fi
+
+          docker build \
+            --file deploy/docker/Dockerfile \
+            --build-arg VERSION="$version" \
+            --build-arg COMMIT_SHA="$GITHUB_SHA" \
+            --tag "$GOCHAT_IMAGE:$GITHUB_SHA" \
+            .
+          docker push "$GOCHAT_IMAGE:$GITHUB_SHA"
+
+          docker build \
+            --file channels/shangwutong/Dockerfile \
+            --build-arg VERSION="$version" \
+            --build-arg COMMIT_SHA="$GITHUB_SHA" \
+            --tag "$SHANGWUTONG_IMAGE:$GITHUB_SHA" \
+            .
+          docker push "$SHANGWUTONG_IMAGE:$GITHUB_SHA"
+
+          if [ "$GITHUB_REF_NAME" = "main" ]; then
+            docker tag "$GOCHAT_IMAGE:$GITHUB_SHA" "$GOCHAT_IMAGE:latest"
+            docker tag "$SHANGWUTONG_IMAGE:$GITHUB_SHA" \
+              "$SHANGWUTONG_IMAGE:latest"
+            docker push "$GOCHAT_IMAGE:latest"
+            docker push "$SHANGWUTONG_IMAGE:latest"
+          elif [ "$GITHUB_REF_NAME" != "${GITHUB_REF_NAME#v}" ]; then
+            docker tag "$GOCHAT_IMAGE:$GITHUB_SHA" "$GOCHAT_IMAGE:$version"
+            docker tag "$SHANGWUTONG_IMAGE:$GITHUB_SHA" \
+              "$SHANGWUTONG_IMAGE:$version"
+            docker push "$GOCHAT_IMAGE:$version"
+            docker push "$SHANGWUTONG_IMAGE:$version"
+          fi