diff --git a/.woodpecker.yml b/.woodpecker.yml
new file mode 100644
index 0000000..4c20f6f
--- /dev/null
+++ b/.woodpecker.yml
@@ -0,0 +1,23 @@
+# Woodpecker CI pipeline.
+# Server: ci.lthn.sh. Lint + sonar in parallel, both depend only on clone.
+# sonar_token is admin-scoped on the Woodpecker server.
+
+when:
+  - event: push
+    branch: [dev, main]
+
+steps:
+  - name: phpstan
+    image: ghcr.io/phpstan/phpstan:latest
+    depends_on: []
+    commands:
+      - if [ -f phpstan.neon ] || [ -f phpstan.neon.dist ]; then phpstan analyse --no-progress --memory-limit=1G; else echo 'no phpstan config — sonar-only'; fi
+  - name: sonar
+    image: sonarsource/sonar-scanner-cli:latest
+    depends_on: []
+    environment:
+      SONAR_HOST_URL: https://sonar.lthn.sh
+      SONAR_TOKEN:
+        from_secret: sonar_token
+    commands:
+      - sonar-scanner
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..c40aaaf
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,7 @@
+sonar.projectKey=core_php-template
+sonar.projectName=core/php-template
+sonar.sources=.
+sonar.exclusions=**/vendor/**,**/third_party/**,**/.tmp/**,**/gomodcache/**,**/node_modules/**,**/dist/**,**/build/**,**/*_test.go,**/*.test.ts,**/*.test.js,**/*.spec.ts,**/*.spec.js
+sonar.tests=.
+sonar.test.inclusions=**/*_test.go,**/*.test.ts,**/*.test.js,**/*.spec.ts,**/*.spec.js
+sonar.test.exclusions=**/vendor/**,**/third_party/**,**/.tmp/**,**/gomodcache/**,**/node_modules/**,**/dist/**,**/build/**