diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..33c6d1d
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+  RUST_TOOLCHAIN: "1.86"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+
+jobs:
+  ci:
+    name: Linux x86_64 (Forgejo)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout text-deontic-extract via external URL
+        run: |
+          set -eu
+          mkdir -p "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git init -q
+          git remote add origin \
+            "https://x-access-token:${GITHUB_TOKEN}@git.flemming.ws/${GITHUB_REPOSITORY}.git"
+          git fetch --depth=1 origin "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
+
+      - name: Configure git URL rewrite for SDK fetch
+        env:
+          SDK_PAT: ${{ secrets.MODULE_SDK_PAT }}
+        run: |
+          git config --global \
+            "url.https://x-access-token:${SDK_PAT}@git.flemming.ws/.insteadOf" \
+            "https://git.flemming.ws/"
+
+      - name: Install system dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            curl ca-certificates build-essential pkg-config libssl-dev git
+
+      - name: Install Rust toolchain
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y --profile minimal \
+              --default-toolchain "$RUST_TOOLCHAIN" \
+              --target wasm32-wasip2 --component rustfmt --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cargo fmt --check
+        run: cargo fmt --all -- --check
+
+      - name: Cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Cargo build (host)
+        run: cargo build --all-targets
+
+      - name: Cargo test (host)
+        run: cargo test --all-targets
+
+      - name: Cargo build (wasm32-wasip2)
+        run: cargo build --release --target wasm32-wasip2
diff --git a/module.wasm b/module.wasm
index 6e40ba7..c560e1c 100644
Binary files a/module.wasm and b/module.wasm differ
diff --git a/src/lib.rs b/src/lib.rs
index 859fb34..938ee24 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -22,6 +22,7 @@ use serde::{Deserialize, Serialize};
 
 #[derive(Debug, Deserialize)]
 struct InputNorm {
+    #[allow(dead_code)]
     eli: Option<String>,
     jurabk: Option<String>,
     paragraph: Option<String>,
@@ -90,7 +91,10 @@ pub fn invoke(_ctx: Context, inputs: Inputs) -> Result<Outputs, ModuleError> {
     } else {
         duties.iter().map(|d| d.confidence).sum::<f32>() / duties.len() as f32
     };
-    let out = Output { duties, avg_confidence: avg };
+    let out = Output {
+        duties,
+        avg_confidence: avg,
+    };
     Outputs::new().with_json("duties", &out)
 }
 
@@ -102,7 +106,11 @@ fn compile_patterns() -> Result<Vec<(&'static str, f32, Regex)>, ModuleError> {
         (MOD_OBLIGATION, 0.85, r"\bsind\s+verpflichtet\b"),
         (MOD_OBLIGATION, 0.80, r"\b(?:ist|sind)\s+anzuzeigen\b"),
         (MOD_OBLIGATION, 0.80, r"\baufzuzeichnen\b"),
-        (MOD_OBLIGATION, 0.80, r"\b(?:muss|müssen)\s+\w+\s+(?:eingehalten|gef[uü]hrt|gemeldet|nachgewiesen)\b"),
+        (
+            MOD_OBLIGATION,
+            0.80,
+            r"\b(?:muss|müssen)\s+\w+\s+(?:eingehalten|gef[uü]hrt|gemeldet|nachgewiesen)\b",
+        ),
         (MOD_PROHIBITION, 0.85, r"\bdarf\s+(?:nicht|kein)\b"),
         (MOD_PROHIBITION, 0.85, r"\bd[uü]rfen\s+(?:nicht|kein)\b"),
         (MOD_PROHIBITION, 0.85, r"\b(?:ist|sind)\s+untersagt\b"),
@@ -113,16 +121,15 @@ fn compile_patterns() -> Result<Vec<(&'static str, f32, Regex)>, ModuleError> {
     ];
     let mut out = Vec::with_capacity(raw.len());
     for (m, c, src) in raw {
-        let re = Regex::new(src).map_err(|e| {
-            ModuleError::invalid_input(format!("internal regex compile: {e}"))
-        })?;
+        let re = Regex::new(src)
+            .map_err(|e| ModuleError::invalid_input(format!("internal regex compile: {e}")))?;
         out.push((m, c, re));
     }
     Ok(out)
 }
 
 fn split_sentences(text: &str) -> Vec<&str> {
-    text.split_terminator(|c: char| c == '.' || c == ';' || c == '\n')
+    text.split_terminator(['.', ';', '\n'])
         .map(str::trim)
         .filter(|s| !s.is_empty() && s.len() > 4)
         .collect()
@@ -130,6 +137,7 @@ fn split_sentences(text: &str) -> Vec<&str> {
 
 #[cfg(test)]
 mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
     use super::*;
 
     fn norm(paragraphs: Vec<(&str, &str)>) -> serde_json::Value {
@@ -169,7 +177,10 @@ mod tests {
         } else {
             duties.iter().map(|d| d.confidence).sum::<f32>() / duties.len() as f32
         };
-        Output { duties, avg_confidence: avg }
+        Output {
+            duties,
+            avg_confidence: avg,
+        }
     }
 
     #[test]
@@ -193,7 +204,10 @@ mod tests {
 
     #[test]
     fn no_duty_means_zero_avg() {
-        let result = extract(norm(vec![("(1)", "Dieser Satz enthält nichts Deontisches.")]));
+        let result = extract(norm(vec![(
+            "(1)",
+            "Dieser Satz enthält nichts Deontisches.",
+        )]));
         assert_eq!(result.duties.len(), 0);
         assert_eq!(result.avg_confidence, 0.0);
     }