diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index c578b37..199b12d 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,166 +1,75 @@
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
-# pad
+# ============================================================================
+# Template — .gitea/workflows/ci.yml
+# Drop this file into each app repo (adjust LIONS_JAVA_VERSION +
+# LIONS_APP_NAME + optional --deploy-repo-url). It runs inside the
+# registry.lions.dev/lionsdev/lionsctl-ci:latest image, so lionsctl,
+# kubectl, helm, docker CLI, JDK 17+21 and Maven are all pre-installed.
+#
+# Required Gitea repo secrets:
+#   LIONS_REGISTRY_USERNAME   (typically "lionsregistry")
+#   LIONS_REGISTRY_PASSWORD
+#   LIONS_GIT_USERNAME        (typically "lionsdev")
+#   LIONS_GIT_ACCESS_TOKEN    (Gitea PAT with write:repository, write:package)
+#   LIONS_GIT_PASSWORD        (Gitea password for same user — Helm mode)
+#   SMTP_HOST SMTP_PORT SMTP_USERNAME SMTP_PASSWORD SMTP_FROM
+# ============================================================================
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches: [ main ]
+  workflow_dispatch: {}
+
+env:
+  # Adjust per repo:
+  #   - unionflow-server-impl-quarkus      -> 21
+  #   - all others                         -> 17
+  LIONS_JAVA_VERSION: "17"
+  LIONS_CLUSTER: "k1"
+
+jobs:
+  pipeline:
+    runs-on: ubuntu-latest
+    container:
+      image: registry.lions.dev/lionsdev/lionsctl-ci:latest
+      credentials:
+        username: ${{ secrets.LIONS_REGISTRY_USERNAME }}
+        password: ${{ secrets.LIONS_REGISTRY_PASSWORD }}
+      # Mount the host docker socket so `docker build/push` inside the
+      # container hits the runner's daemon (DinD-free).
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+
+    steps:
+      - name: Show tooling
+        run: |
+          lionsctl --version || true
+          docker --version
+          kubectl version --client=true
+          helm version --short
+          mvn --version | head -n2
+
+      - name: Pipeline deploy
+        env:
+          LIONS_REGISTRY_USERNAME: ${{ secrets.LIONS_REGISTRY_USERNAME }}
+          LIONS_REGISTRY_PASSWORD: ${{ secrets.LIONS_REGISTRY_PASSWORD }}
+          LIONS_GIT_USERNAME:      ${{ secrets.LIONS_GIT_USERNAME }}
+          LIONS_GIT_ACCESS_TOKEN:  ${{ secrets.LIONS_GIT_ACCESS_TOKEN }}
+          LIONS_GIT_PASSWORD:      ${{ secrets.LIONS_GIT_PASSWORD }}
+          SMTP_HOST:               ${{ secrets.SMTP_HOST }}
+          SMTP_PORT:               ${{ secrets.SMTP_PORT }}
+          SMTP_USERNAME:           ${{ secrets.SMTP_USERNAME }}
+          SMTP_PASSWORD:           ${{ secrets.SMTP_PASSWORD }}
+          SMTP_FROM:               ${{ secrets.SMTP_FROM }}
+        # No actions/checkout — lionsctl clones internally using git_access_token.
+        run: |
+          # For btpxpress-backend add:  --deploy-repo-url https://git.lions.dev/lionsdev/btpxpress-server-k1
+          # For btpxpress-frontend add: --deploy-repo-url https://git.lions.dev/lionsdev/btpxpress-client-k1
+          lionsctl pipeline \
+            -u ${{ gitea.server_url }}/${{ gitea.repository }} \
+            -b ${{ gitea.ref_name }} \
+            -j ${{ env.LIONS_JAVA_VERSION }} \
+            -e production \
+            -c ${{ env.LIONS_CLUSTER }} \
+            -p prod \
+            -m admin@lions.dev