.gitignore

@@ -9,6 +9,7 @@ run.sh
 !.gitignore
 !.gitattributes
 !.github
+!.gitlab-ci.yml
 CLAUDE.md
 
 # The cutover rehearsal writes its fixture and state here.

.gitlab-ci.yml

@@ -0,0 +1,50 @@
+# CI on the self-hosted GitLab, ported from .github/workflows/ci.yml when the
+# GitHub account was suspended on 2026-09-20. The Actions file stays in the
+# tree: it is the reference this was written from and works unchanged if the
+# appeal succeeds.
+#
+# The image is pinned by digest, with its tag in the trailing comment. That
+# replaces the SHA-pinned `uses:` in the workflow -- GitLab has no action
+# allowlist, so the digest is the only thing fixing what actually runs.
+#
+# Not ported here:
+#   * cleanup.yml pruned GHCR with dataaxiom/ghcr-cleanup-action. GitLab has
+#     no equivalent action because it does not need one: the container
+#     registry has a cleanup policy on the project itself, which is where that
+#     job's settings now live.
+#   * publish.yml and release.yml still need doing; they are larger and are
+#     being handled separately.
+
+stages: [build]
+
+default:
+  interruptible: true
+
+build:
+  stage: build
+  image: rust:1-bookworm@sha256:93ce27a88655056a51dbdd8f5f2d7ddc071c7b0070fb288a37b5a285fc83971e # 1-bookworm
+  # This is a big workspace and a cold build is expensive, so the registry and
+  # the target directory are cached between runs. Both are kept inside the
+  # project directory because that is the only path the runner will cache --
+  # and deliberately not on /tmp, which on this host is a tmpfs that a Rust
+  # build of this size has filled before.
+  variables:
+    CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
+    CARGO_TARGET_DIR: "$CI_PROJECT_DIR/target"
+    CARGO_INCREMENTAL: "0"
+  cache:
+    key:
+      files: [Cargo.lock]
+    paths:
+      - .cargo/registry/
+      - target/
+  before_script:
+    - apt-get update -qq && apt-get install -y -qq --no-install-recommends clang >/dev/null
+  script:
+    - cargo build -p inbuxa --locked
+    # --no-run: the workflow compiled every test target without running them,
+    # which catches a test that no longer builds without paying for the suite.
+    - cargo test --workspace --locked --no-run
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH