diff --git a/.gitea/workflows/validate.yml b/.gitea/workflows/validate.yml
new file mode 100644
index 0000000..7023c2b
--- /dev/null
+++ b/.gitea/workflows/validate.yml
@@ -0,0 +1,45 @@
+name: Validation applicative
+
+on:
+  push:
+    branches: [main, master]
+    paths-ignore:
+      - "**.md"
+      - "docs/**"
+  pull_request:
+    branches: [main, master]
+    paths-ignore:
+      - "**.md"
+      - "docs/**"
+  workflow_dispatch:
+
+jobs:
+  verify:
+    name: TypeScript, tests et build
+    # Label dédié : image locale avec Node 22, pnpm verrouillé et Bash déjà installés.
+    runs-on: ci-node22
+    timeout-minutes: 15
+    steps:
+      - name: Récupérer les sources
+        uses: actions/checkout@v4
+
+      - name: Calculer la clé de cache pnpm
+        id: pnpm-cache-key
+        shell: bash
+        run: |
+          echo "store=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+          echo "lock=$(sha256sum pnpm-lock.yaml | cut -d ' ' -f 1)" >> "$GITHUB_OUTPUT"
+
+      - name: Restaurer le store pnpm
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-cache-key.outputs.store }}
+          key: pnpm-${{ runner.os }}-${{ steps.pnpm-cache-key.outputs.lock }}
+          restore-keys: |
+            pnpm-${{ runner.os }}-
+
+      - name: Installer les dépendances verrouillées
+        run: pnpm install --frozen-lockfile --prefer-offline
+
+      - name: Vérifier TypeScript, tests et build
+        run: pnpm verify
diff --git a/app.json b/app.json
index a216513..38687c8 100644
--- a/app.json
+++ b/app.json
@@ -9,5 +9,8 @@
   "containerName": "itinova-podcasts",
   "image": "images/itinova-podcasts.png",
   "giteaRepo": "itinova-podcasts",
-  "giteaOwner": "manus-admin"
+  "giteaOwner": "manus-admin",
+  "ci": {
+    "required": true
+  }
 }
diff --git a/package.json b/package.json
index f3251d4..d9cbf54 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,8 @@
     "check": "tsc --noEmit",
     "format": "prettier --write .",
     "test": "vitest run",
-    "db:push": "drizzle-kit generate && drizzle-kit migrate"
+    "db:push": "drizzle-kit generate && drizzle-kit migrate",
+    "verify": "pnpm check && pnpm test && pnpm build"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.693.0",
@@ -114,4 +115,4 @@
       "tailwindcss>nanoid": "3.3.7"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/server/_core/index.ts b/server/_core/index.ts
index 729a22c..b22419f 100644
--- a/server/_core/index.ts
+++ b/server/_core/index.ts
@@ -99,4 +99,7 @@ async function startServer() {
   });
 }
 
-startServer().catch(console.error);
+// Vitest ne doit jamais démarrer un serveur HTTP.
+if (!process.env.VITEST) {
+  startServer().catch(console.error);
+}
diff --git a/server/auth.local.test.ts b/server/auth.local.test.ts
index 001d665..8daf0ff 100644
--- a/server/auth.local.test.ts
+++ b/server/auth.local.test.ts
@@ -1,4 +1,14 @@
 import { describe, expect, it, vi, beforeEach } from "vitest";
+
+// En CI, JWT_SECRET n'est pas défini.
+vi.hoisted(() => {
+  if (!process.env.JWT_SECRET) {
+    process.env.JWT_SECRET = "ci-test-secret-key-at-least-32-chars-long!!";
+  }
+});
+
+// En CI, skip si pas de DATABASE_URL.
+const describeIntegration = process.env.DATABASE_URL ? describe : describe.skip;
 import { appRouter } from "./routers";
 import type { TrpcContext } from "./_core/context";
 import bcrypt from "bcryptjs";
@@ -87,7 +97,7 @@ function makePublicCtx(): TrpcContext {
 
 // ─── Tests ─────────────────────────────────────────────────────────────────────
 
-describe("auth.loginLocal", () => {
+describeIntegration("auth.loginLocal", () => {
   it("réussit avec les bonnes credentials adminServPodcast", async () => {
     const ctx = makePublicCtx();
     const caller = appRouter.createCaller(ctx);