diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d366746..9fd9a91 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,8 +1,10 @@
 #=======================================================================
 # FILE:  .gitea/workflows/ci.yml
 # DESC:  CI/CD for H100PowerManger
-#        - build/test on aarch64 (via QEMU emulation of arm64 Ubuntu 20.04)
+#        - build/test on aarch64 (QEMU emulation of arm64 Ubuntu 20.04)
 #        - deploy the cross-built binary to the RK3588 board
+#        NOTE: self-contained (no external actions), runner host needs
+#              Docker + internet to pull images + privileged for QEMU.
 #=======================================================================
 
 name: build-test-deploy
@@ -15,55 +17,53 @@ on:
 
 env:
   CI_IMAGE: h100-power-manager-ci:arm64
+  GITEA_SERVER: ${{ vars.GITEA_SERVER_URL }}
 
 jobs:
-  #---------------------------------------------------------------------
-  # Build (aarch64) + unit test + startup smoke test
-  #---------------------------------------------------------------------
-  build-test:
+  ci:
     runs-on: <runner_labels>
     steps:
+      #-------------------------------------------------------------------
+      # Checkout via git (no external actions/checkout dependency)
+      #-------------------------------------------------------------------
       - name: Checkout
-        uses: actions/checkout@v4
+        run: |
+          set -euo pipefail
+          SERVER="${GITEA_SERVER:-https://gitea2.zhaojingkui.xyz}"
+          REPO_URL="${SERVER}/zjk/H100PowerManger.git"
+          git init .
+          git remote add origin "https://zjk:${{ secrets.CI_TOKEN }}@$(echo "${REPO_URL}" | sed 's|^https://||')"
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout FETCH_HEAD
 
+      #-------------------------------------------------------------------
+      # Register QEMU so arm64 binaries/images can run on the x86 runner
+      #-------------------------------------------------------------------
       - name: Register QEMU for arm64
         run: |
           docker run --rm --privileged tonistiigi/binfmt --install arm64
 
+      #-------------------------------------------------------------------
+      # Build the aarch64 CI image (MOOS-IvP + jsoncpp)
+      #-------------------------------------------------------------------
       - name: Build arm64 CI image
         run: |
           docker build -t "$CI_IMAGE" -f ci/Dockerfile .
 
+      #-------------------------------------------------------------------
+      # Build project + unit test + startup smoke test (inside arm64)
+      #-------------------------------------------------------------------
       - name: Build & test inside arm64 container
         run: |
           docker run --rm \
             -v "$GITHUB_WORKSPACE:/src" \
             "$CI_IMAGE" /src/ci/build-test.sh
 
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: arm64-bin
-          path: |
-            bin/pPowerManger
-            bin/pPMtest
-            bin/SQLiteTest
-
-  #---------------------------------------------------------------------
-  # Deploy the binary to the RK3588 board (push only, no restart)
-  #---------------------------------------------------------------------
-  deploy:
-    needs: build-test
-    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
-    runs-on: <runner_labels>
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v3
-        with:
-          name: arm64-bin
-          path: bin/
-
+      #-------------------------------------------------------------------
+      # Deploy the cross-built binary to the RK3588 board (push only)
+      #-------------------------------------------------------------------
       - name: Deploy to board
+        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
         env:
           DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
           DEPLOY_USER: ${{ vars.DEPLOY_USER }}
@@ -72,7 +72,7 @@ jobs:
         run: |
           set -euo pipefail
           USER="${DEPLOY_USER:-root}"
-          HOST="${DEPLOY_HOST:?DEPLOY_HOST secret is not set}"
+          HOST="${DEPLOY_HOST:?DEPLOY_HOST secret not set}"
           DEST="${DEPLOY_PATH:-/root/work/moos_ws/moos-ivp-extend/bin}"
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
           printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519