diff --git a/.gitea/workflows/cicd.yml b/.gitea/workflows/cicd.yml
new file mode 100644
index 0000000..f61f341
--- /dev/null
+++ b/.gitea/workflows/cicd.yml
@@ -0,0 +1,71 @@
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+env:
+  REGISTRY: git.hnrx.net
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  lint:
+    name: Lint & Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      
+      - name: Install uv
+        uses: astral-sh/setup-uv@v2
+        with:
+          version: "latest"
+          enable-cache: true
+          
+      - name: Install dependencies
+        run: uv sync --frozen --dev
+
+      - name: Run Ruff (Lint & Syntax Check)
+        run: uv run ruff check src
+
+  build-and-push:
+    name: Build & Push Docker Image
+    needs: lint
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
diff --git a/TODO.md b/TODO.md
index 2474a81..e3e1020 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,25 +1,25 @@
 # Strava MCP Server — Next Steps
 
 ## 🐳 Docker Container bauen
-- [ ] `Dockerfile` erstellen (Python-Base-Image, `uv`-basiert)
-- [ ] `.dockerignore` anlegen (`.env`, `__pycache__`, `.venv` etc.)
-- [ ] Umgebungsvariablen via `--env-file` oder Docker Secrets einbinden
+- [x] `Dockerfile` erstellen (Python-Base-Image, `uv`-basiert)
+- [x] `.dockerignore` anlegen (`.env`, `__pycache__`, `.venv` etc.)
+- [x] Umgebungsvariablen via `--env-file` oder Docker Secrets einbinden
 - [ ] `docker-compose.yml` für lokales Testing
-- [ ] Image testen: `docker run -p 8000:8000 strava-mcp-server`
+- [x] Image testen: `docker run -p 8000:8000 strava-mcp-server`
 
 ---
 
 ## 🔁 Gitea Action erstellen
-- [ ] `.gitea/workflows/` Verzeichnis anlegen
-- [ ] CI-Workflow definieren (Lint + ggf. Syntax-Check)
-- [ ] Build & Push des Docker Images in Gitea Container Registry
-- [ ] Secrets in Gitea hinterlegen (`STRAVA_CLIENT_ID`, `STRAVA_CLIENT_SECRET`)
+- [x] `.gitea/workflows/` Verzeichnis anlegen
+- [x] CI-Workflow definieren (Lint + ggf. Syntax-Check)
+- [x] Build & Push des Docker Images in Gitea Container Registry
+- [x] Secrets in Gitea hinterlegen (`STRAVA_CLIENT_ID`, `STRAVA_CLIENT_SECRET`)
 - [ ] Optional: Auto-Deploy auf Server nach erfolgreichem Build
 
 ---
 
 ## 🔑 Anmeldung vereinfachen
-- [ ] OAuth-Flow direkt in den Server integrieren (kein separates `get_token.py` mehr)
-- [ ] Callback-Endpoint `/auth/callback` im FastMCP-Server ergänzen
-- [ ] `STRAVA_REFRESH_TOKEN` automatisch in `.env` zurückschreiben nach Token-Rotation
-- [ ] Optionaler Hinweis beim Start falls kein Token vorhanden ist
+- [x] OAuth-Flow direkt in den Server integrieren (kein separates `get_token.py` mehr)
+- [x] Callback-Endpoint `/auth/callback` im FastMCP-Server ergänzen
+- [x] `STRAVA_REFRESH_TOKEN` automatisch in `.env` zurückschreiben nach Token-Rotation
+- [x] Optionaler Hinweis beim Start falls kein Token vorhanden ist