diff --git a/.gitea/workflows/test.yaml b/.gitea/workflows/test.yaml
new file mode 100644
index 0000000..8478c50
--- /dev/null
+++ b/.gitea/workflows/test.yaml
@@ -0,0 +1,87 @@
+name: CI Tests
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: ${{ matrix.image_set.name }} (sbom=${{ matrix.use_inbuild_sbom }})
+    runs-on: k8s
+    strategy:
+      fail-fast: false
+      matrix:
+        image_set:
+          # Test 1: Slim images with built-in SBOMs (2 architectures, 15-40 CVEs each)
+          - name: with-inbuild-sbom
+            head_image: debian:bookworm-slim
+            target_image: debian:bullseye-slim
+            architectures: amd64,arm64
+            expect_arch_col: true
+
+          # Test 2: Slim images without built-in SBOMs (1 architecture, 70-120 CVEs each)
+          - name: without-inbuild-sbom
+            head_image: debian:buster-slim
+            target_image: debian:stretch-slim
+            architectures: amd64
+            expect_arch_col: false
+
+          # Test 3: Cross-check (Head has built-in SBOM, Target does not, 15-70 CVEs each)
+          - name: cross-check-mixed-sbom
+            head_image: debian:bookworm-slim
+            target_image: debian:buster-slim
+            architectures: amd64
+            expect_arch_col: false
+
+        use_inbuild_sbom:
+          - "true"
+          - "false"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Test CVE Differential Action
+        uses: ./
+        with:
+          head-image: ${{ matrix.image_set.head_image }}
+          target-image: ${{ matrix.image_set.target_image }}
+          target-branch: main
+          architectures: ${{ matrix.image_set.architectures }}
+          use-inbuild-sbom: ${{ matrix.use_inbuild_sbom }}
+          output-delta: cve-delta.md
+          output-summary: cve-summary.md
+
+      - name: Verify Report Generation & Content
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          test -s cve-delta.md || (echo "::error::cve-delta.md is empty or missing" && exit 1)
+          test -s cve-summary.md || (echo "::error::cve-summary.md is empty or missing" && exit 1)
+
+          # Verify that each scan produced at least 3 CVE findings
+          cve_count=$(grep -c "CVE-" cve-summary.md || echo 0)
+          echo "Total CVE entries found in summary report: $cve_count"
+          if [ "$cve_count" -lt 3 ]; then
+            echo "::error::Expected at least 3 CVEs in cve-summary.md, found only $cve_count"
+            exit 1
+          fi
+
+          echo "=== Delta Report Preview ==="
+          head -n 25 cve-delta.md
+
+          # Verify architectural column rendering behavior
+          if [ "${{ matrix.image_set.expect_arch_col }}" = "true" ]; then
+            grep -q "| Arch |" cve-delta.md || (echo "::error::Expected Arch column in multi-arch report" && exit 1)
+          else
+            if grep -q "| Arch |" cve-delta.md; then
+              echo "::error::Did not expect Arch column in single-arch report" && exit 1
+            fi
+          fi
+          echo "✅ All assertions passed (including >= 3 CVEs verification)."