diff --git a/.forgejo/workflows/diag.yml b/.forgejo/workflows/diag.yml
new file mode 100644
index 0000000..3e1ef88
--- /dev/null
+++ b/.forgejo/workflows/diag.yml
@@ -0,0 +1,74 @@
+name: diag
+
+# Diagnostic minimal : vérifie que le runner Forgejo démarre, qu'il
+# peut cloner, et qu'il a accès à Internet + Docker (pour le label
+# docker:// sur lequel tournent nos jobs).
+#
+# À supprimer une fois qu'on a confirmé que le runner est OK.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  diag:
+    runs-on: docker
+    container:
+      image: docker.io/pazof/yavsc-build-env:debian12-dotnet10-android36-v2
+    steps:
+      - name: Hello
+        run: |
+          echo "Runner started, container is alive."
+          echo "Image: $(cat /etc/os-release | grep PRETTY_NAME)"
+          echo "Hostname: $(hostname)"
+          echo "User: $(whoami)"
+          echo "Working dir: $(pwd)"
+
+      - name: Network check
+        run: |
+          echo "--- DNS resolution ---"
+          getent hosts forgejo.pschneider.fr || echo "FAIL: cannot resolve forgejo.pschneider.fr"
+          echo "--- HTTP outbound ---"
+          curl -sS -o /dev/null -w "forgejo.pschneider.fr HTTP %{http_code} (%{time_total}s)\n" \
+            https://forgejo.pschneider.fr/ || echo "FAIL: cannot reach forgejo.pschneider.fr"
+          echo "--- Docker Hub ---"
+          curl -sS -o /dev/null -w "hub.docker.com HTTP %{http_code}\n" \
+            https://hub.docker.com/ || echo "FAIL: cannot reach hub.docker.com"
+
+      - name: Tooling check
+        run: |
+          echo "--- git ---"
+          git --version
+          echo "--- dotnet ---"
+          dotnet --info | head -5
+          echo "--- jq ---"
+          jq --version
+          echo "--- curl ---"
+          curl --version | head -1
+          echo "--- make ---"
+          make --version | head -1
+          echo "--- debhelper ---"
+          which dh || echo "FAIL: dh not found (debhelper absent)"
+          echo "--- imagemagick ---"
+          which convert || echo "FAIL: convert not found"
+
+      - name: Forgejo context probe
+        env:
+          FORGEJO_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        run: |
+          echo "--- forgejo.* context ---"
+          echo "forgejo.ref_name=[${{ forgejo.ref_name }}]"
+          echo "forgejo.repository=[${{ forgejo.repository }}]"
+          echo "forgejo.api_url=[${{ forgejo.api_url }}]"
+          echo "--- secrets.GITHUB_TOKEN probe ---"
+          if [[ -n "$FORGEJO_TOKEN" ]]; then
+            echo "FORGEJO_TOKEN is set (length=${#FORGEJO_TOKEN})"
+          else
+            echo "FORGEJO_TOKEN is EMPTY — secrets.GITHUB_TOKEN did not resolve"
+          fi
+          echo "--- API reachability via FORGEJO_TOKEN ---"
+          if [[ -n "$FORGEJO_TOKEN" ]]; then
+            HTTP=$(curl -sS -o /dev/null -w '%{http_code}' \
+              -H "Authorization: token $FORGEJO_TOKEN" \
+              "${{ forgejo.api_url }}/repos/${{ forgejo.repository }}")
+            echo "GET /repos/${{ forgejo.repository }} -> HTTP $HTTP"
+          fi
\ No newline at end of file