diff --git a/cli/.forgejo/workflows/publish.yml b/cli/.forgejo/workflows/publish.yml
new file mode 100644
index 0000000..3ebd268
--- /dev/null
+++ b/cli/.forgejo/workflows/publish.yml
@@ -0,0 +1,144 @@
+# =============================================================================
+# Forgejo Actions Workflow - Config Package Publishing
+# =============================================================================
+# Simplified template for config-only packages (no build step required)
+#
+# Use for:
+#   - ESLint configurations
+#   - TypeScript configurations
+#   - Prettier configurations
+#   - JSON/YAML config packages
+#   - Any package where source === dist
+#
+# Features:
+#   - JSON/YAML validation
+#   - Version existence check
+#   - No build step (publishes source directly)
+#   - Fast CI (< 1 minute typical)
+#
+# Usage:
+#   1. Copy to: <package>/.forgejo/workflows/publish.yml
+#   2. Ensure package.json has metadata:
+#      "_": { "registry": "forgejo", "publish": true, "build": false }
+#   3. Commit and push to main/master
+#
+# Secrets required:
+#   - NPM_TOKEN: Forgejo npm registry token
+# =============================================================================
+
+name: Validate and Publish
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+env:
+  NODE_VERSION: '20'
+
+jobs:
+  validate-and-publish:
+    runs-on: ubuntu-latest
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        run: |
+          echo "=== Node.js version ==="
+          node --version && npm --version
+          echo "✓ Node.js ready"
+
+      - name: Configure npm for Forgejo registry
+        run: |
+          echo "@lilith:registry=https://forge.nasty.sh/api/packages/lilith/npm/" > .npmrc
+          echo "//forge.nasty.sh/api/packages/lilith/npm/:_authToken=\${NPM_TOKEN}" >> .npmrc
+          echo "strict-ssl=false" >> .npmrc
+          echo "✓ Configured Forgejo registry"
+
+      - name: Validate configuration files
+        run: |
+          echo "=== Validating configuration files ==="
+
+          # Validate JSON files
+          for f in *.json; do
+            if [ -f "$f" ]; then
+              if node -e "JSON.parse(require('fs').readFileSync('$f', 'utf8'))" 2>&1; then
+                echo "✓ Valid JSON: $f"
+              else
+                echo "✗ Invalid JSON: $f"
+                exit 1
+              fi
+            fi
+          done
+
+          # Validate YAML files
+          for f in *.yaml *.yml; do
+            if [ -f "$f" ] && [ "$f" != "publish.yml" ] && [ "$f" != "publish-config.yml" ]; then
+              if node -e "require('js-yaml').load(require('fs').readFileSync('$f', 'utf8'))" 2>/dev/null; then
+                echo "✓ Valid YAML: $f"
+              else
+                echo "⚠ Could not validate YAML: $f (js-yaml not available, skipping)"
+              fi
+            fi
+          done
+
+          # Validate package.json specifically
+          if [ -f "package.json" ]; then
+            if node -p "JSON.stringify(require('./package.json'), null, 2)" > /dev/null 2>&1; then
+              echo "✓ Valid package.json"
+            else
+              echo "✗ Invalid package.json"
+              exit 1
+            fi
+          fi
+
+          echo "✓ All configuration files valid"
+
+      - name: Check and Publish
+        run: |
+          echo "=== Publish Configuration ==="
+
+          pkg_name=$(node -p "require('./package.json').name")
+          pkg_version=$(node -p "require('./package.json').version")
+          should_publish=$(node -p "require('./package.json')._?.publish === true")
+          registry=$(node -p "require('./package.json')._?.registry || 'none'")
+
+          echo ""
+          echo "Package: $pkg_name@$pkg_version"
+          echo "  Publish: $should_publish"
+          echo "  Registry: $registry"
+          echo ""
+
+          # Check registry configuration
+          if [ "$registry" != "forgejo" ]; then
+            echo "⊘ Skipping: registry is not 'forgejo' (got: $registry)"
+            echo "  To enable publishing, add to package.json:"
+            echo "  \"_\": { \"registry\": \"forgejo\", \"publish\": true }"
+            exit 0
+          fi
+
+          # Publish if configured
+          if [ "$should_publish" = "true" ]; then
+            echo "=== Checking if version already published ==="
+            if npm view "$pkg_name@$pkg_version" version 2>/dev/null; then
+              echo "✓ Version $pkg_version already published to registry"
+              echo "  No action needed"
+            else
+              echo "→ Version $pkg_version not found in registry"
+              echo ""
+              echo "=== Publishing to Forgejo registry ==="
+              if npm publish --access public --no-git-checks 2>&1; then
+                echo ""
+                echo "✓ Successfully published $pkg_name@$pkg_version"
+                echo "  Registry: https://forge.nasty.sh/lilith/-/packages/npm/$pkg_name"
+              else
+                echo "✗ Publish failed"
+                exit 1
+              fi
+            fi
+          else
+            echo "⊘ Publish skipped (publish: false)"
+          fi