diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..195b86137
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,126 @@
+# Lightweight CI for v2.5.5-dev (free for public repos).
+# Validates shell syntax, Python version fetcher, and key files on all supported OSes via Docker.
+# CloudLinux and RHEL use Rocky/Alma images as proxies (same family, no official Docker images).
+name: CI
+
+on:
+  push:
+    branches: [v2.5.5-dev, stable, master]
+  pull_request:
+    branches: [v2.5.5-dev, stable, master]
+
+jobs:
+  validate-shell:
+    name: Validate shell scripts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Syntax check shell scripts
+        run: |
+          for f in cyberpanel_upgrade.sh preUpgrade.sh fix-phpmyadmin.sh cyberpanel.sh cyberpanel_utility.sh; do
+            [ ! -f "$f" ] && continue
+            bash -n "$f" || { echo "FAIL (syntax): $f"; exit 1; }
+            echo "OK $f"
+          done
+          test -f preUpgrade.sh && test -f cyberpanel_upgrade.sh || { echo "Missing required scripts"; exit 1; }
+          echo "All shell scripts passed syntax check"
+
+  validate-python:
+    name: Validate Python (version fetcher)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+      - name: Install requests
+        run: pip install requests
+      - name: Run version fetcher (phpMyAdmin / SnappyMail)
+        run: |
+          PYTHONPATH=. python3 -c "
+          from plogical.versionFetcher import get_latest_phpmyadmin_version, get_latest_snappymail_version
+          pma = get_latest_phpmyadmin_version()
+          snappy = get_latest_snappymail_version()
+          assert pma and len(pma) >= 5, 'phpMyAdmin version invalid'
+          assert snappy and len(snappy) >= 3, 'SnappyMail version invalid'
+          print('phpMyAdmin:', pma, 'SnappyMail:', snappy)
+          "
+
+  smoke-key-files:
+    name: Key files present
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check key install/upgrade files exist
+        run: |
+          for f in preUpgrade.sh cyberpanel_upgrade.sh plogical/upgrade.py install/install.py plogical/versionFetcher.py; do
+            test -f "$f" || { echo "Missing: $f"; exit 1; }
+          done
+          grep -q 'BRANCH_NAME' preUpgrade.sh || exit 1
+          grep -q 'Branch_Name\|download_install_phpmyadmin\|Branch_Check' cyberpanel_upgrade.sh || exit 1
+          echo "Key files OK"
+
+  # Run validation inside a container per supported OS (AlmaLinux, CentOS, CloudLinux, Debian, RHEL, Rocky, Ubuntu).
+  validate-on-os:
+    name: Validate on ${{ matrix.os }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: AlmaLinux 8
+            image: almalinux:8
+          - os: AlmaLinux 9
+            image: almalinux:9
+          - os: AlmaLinux 10
+            image: almalinux:10
+          - os: CentOS 7
+            image: centos:7
+          - os: CloudLinux 8
+            image: rockylinux:8
+          - os: CloudLinux 9
+            image: rockylinux:9
+          - os: Debian 11
+            image: debian:11
+          - os: Debian 12
+            image: debian:12
+          - os: Debian 13
+            image: debian:13
+          - os: RHEL 8
+            image: almalinux:8
+          - os: RHEL 9
+            image: almalinux:9
+          - os: RockyLinux 8
+            image: rockylinux:8
+          - os: RockyLinux 9
+            image: rockylinux:9
+          - os: Ubuntu 20.04
+            image: ubuntu:20.04
+          - os: Ubuntu 22.04
+            image: ubuntu:22.04
+          - os: Ubuntu 24.04
+            image: ubuntu:24.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate on ${{ matrix.os }} (${{ matrix.image }})
+        run: |
+          docker run --rm \
+            -v "$PWD:/repo:ro" \
+            -w /repo \
+            "${{ matrix.image }}" \
+            bash -c '
+              set -e
+              echo "=== Shell syntax check ==="
+              for f in cyberpanel_upgrade.sh preUpgrade.sh fix-phpmyadmin.sh cyberpanel.sh cyberpanel_utility.sh; do
+                [ ! -f "$f" ] && continue
+                bash -n "$f" || { echo "FAIL (syntax): $f"; exit 1; }
+                echo "OK $f"
+              done
+              test -f preUpgrade.sh && test -f cyberpanel_upgrade.sh || { echo "Missing required scripts"; exit 1; }
+              echo "=== Key files ==="
+              for f in preUpgrade.sh cyberpanel_upgrade.sh plogical/upgrade.py install/install.py plogical/versionFetcher.py; do
+                test -f "$f" || { echo "Missing: $f"; exit 1; }
+              done
+              grep -q "BRANCH_NAME" preUpgrade.sh && grep -q "Branch_Name\|download_install_phpmyadmin\|Branch_Check" cyberpanel_upgrade.sh || exit 1
+              echo "Done."
+            '
diff --git a/cyberpanel_upgrade.sh b/cyberpanel_upgrade.sh
index 663eb6710..18d34e324 100644
--- a/cyberpanel_upgrade.sh
+++ b/cyberpanel_upgrade.sh
@@ -449,6 +449,7 @@ if [[ "$Server_OS" = "CentOS" ]] || [[ "$Server_OS" = "AlmaLinux9" ]] ; then
     echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Fixing AlmaLinux 9 repos (appstream/baseos) for reliable mirror access" | tee -a /var/log/cyberpanel_upgrade_debug.log
     ALMA_VER="${Server_OS_Version:-9}"
     ARCH="x86_64"
+    ALMA_BASE="https://repo.almalinux.org/almalinux/${ALMA_VER}"
     for repo in /etc/yum.repos.d/almalinux*.repo /etc/yum.repos.d/AlmaLinux*.repo; do
       [[ ! -f "$repo" ]] && continue
       if grep -q '^mirrorlist=' "$repo" 2>/dev/null; then
@@ -457,37 +458,69 @@ if [[ "$Server_OS" = "CentOS" ]] || [[ "$Server_OS" = "AlmaLinux9" ]] ; then
         sed -i 's|^#baseurl=\(.*repo\.almalinux\.org.*\)|baseurl=\1|' "$repo"
       fi
     done
-    # Ensure appstream/baseos have explicit baseurl (avoids "Cannot find valid baseurl"); process any .repo that has these sections
+    # Ensure appstream/baseos have explicit baseurl; support [appstream], [almalinux-appstream], etc.
     for repofile in /etc/yum.repos.d/almalinux.repo /etc/yum.repos.d/almalinux*.repo /etc/yum.repos.d/AlmaLinux*.repo; do
       [[ ! -f "$repofile" ]] && continue
-      if grep -q '^\[appstream\]' "$repofile" 2>/dev/null; then
-        sed -i "/^\[appstream\]/,/^\[/ { s|^#\?baseurl=.*|baseurl=https://repo.almalinux.org/almalinux/${ALMA_VER}/AppStream/${ARCH}/os/|; s|^mirrorlist=.*|#mirrorlist=disabled| }" "$repofile"
-        # Add baseurl if section had only mirrorlist (no baseurl line)
-        if ! sed -n '/^\[appstream\]/,/^\[/p' "$repofile" | grep -q '^baseurl='; then
-          sed -i "/^\[appstream\]/a baseurl=https://repo.almalinux.org/almalinux/${ALMA_VER}/AppStream/${ARCH}/os/" "$repofile"
+      for section in appstream almalinux-appstream AppStream; do
+        if grep -q "^\[${section}\]" "$repofile" 2>/dev/null; then
+          sed -i "/^\[${section}\]/,/^\[/ { s|^#\?baseurl=.*|baseurl=${ALMA_BASE}/AppStream/${ARCH}/os/|; s|^mirrorlist=.*|#mirrorlist=disabled| }" "$repofile"
+          if ! sed -n "/^\[${section}\]/,/^\[/p" "$repofile" | grep -q '^baseurl='; then
+            sed -i "/^\[${section}\]/a baseurl=${ALMA_BASE}/AppStream/${ARCH}/os/" "$repofile"
+          fi
         fi
-      fi
-      if grep -q '^\[baseos\]' "$repofile" 2>/dev/null; then
-        sed -i "/^\[baseos\]/,/^\[/ { s|^#\?baseurl=.*|baseurl=https://repo.almalinux.org/almalinux/${ALMA_VER}/BaseOS/${ARCH}/os/|; s|^mirrorlist=.*|#mirrorlist=disabled| }" "$repofile"
-        if ! sed -n '/^\[baseos\]/,/^\[/p' "$repofile" | grep -q '^baseurl='; then
-          sed -i "/^\[baseos\]/a baseurl=https://repo.almalinux.org/almalinux/${ALMA_VER}/BaseOS/${ARCH}/os/" "$repofile"
+      done
+      for section in baseos almalinux-baseos BaseOS; do
+        if grep -q "^\[${section}\]" "$repofile" 2>/dev/null; then
+          sed -i "/^\[${section}\]/,/^\[/ { s|^#\?baseurl=.*|baseurl=${ALMA_BASE}/BaseOS/${ARCH}/os/|; s|^mirrorlist=.*|#mirrorlist=disabled| }" "$repofile"
+          if ! sed -n "/^\[${section}\]/,/^\[/p" "$repofile" | grep -q '^baseurl='; then
+            sed -i "/^\[${section}\]/a baseurl=${ALMA_BASE}/BaseOS/${ARCH}/os/" "$repofile"
+          fi
         fi
-      fi
-      # CRB (CodeReady Builder) - avoids "Cannot find a valid baseurl for repo: crb"
-      if grep -q '^\[crb\]' "$repofile" 2>/dev/null; then
-        sed -i "/^\[crb\]/,/^\[/ { s|^#\?baseurl=.*|baseurl=https://repo.almalinux.org/almalinux/${ALMA_VER}/CRB/${ARCH}/os/|; s|^mirrorlist=.*|#mirrorlist=disabled| }" "$repofile"
-        if ! sed -n '/^\[crb\]/,/^\[/p' "$repofile" | grep -q '^baseurl='; then
-          sed -i "/^\[crb\]/a baseurl=https://repo.almalinux.org/almalinux/${ALMA_VER}/CRB/${ARCH}/os/" "$repofile"
+      done
+      for section in crb extras; do
+        if grep -q "^\[${section}\]" "$repofile" 2>/dev/null; then
+          [[ "$section" = "crb" ]] && path="CRB" || path="extras"
+          sed -i "/^\[${section}\]/,/^\[/ { s|^#\?baseurl=.*|baseurl=${ALMA_BASE}/${path}/${ARCH}/os/|; s|^mirrorlist=.*|#mirrorlist=disabled| }" "$repofile"
+          if ! sed -n "/^\[${section}\]/,/^\[/p" "$repofile" | grep -q '^baseurl='; then
+            sed -i "/^\[${section}\]/a baseurl=${ALMA_BASE}/${path}/${ARCH}/os/" "$repofile"
+          fi
         fi
-      fi
-      # Extras - avoids "Cannot find a valid baseurl for repo: extras"
-      if grep -q '^\[extras\]' "$repofile" 2>/dev/null; then
-        sed -i "/^\[extras\]/,/^\[/ { s|^#\?baseurl=.*|baseurl=https://repo.almalinux.org/almalinux/${ALMA_VER}/extras/${ARCH}/os/|; s|^mirrorlist=.*|#mirrorlist=disabled| }" "$repofile"
-        if ! sed -n '/^\[extras\]/,/^\[/p' "$repofile" | grep -q '^baseurl='; then
-          sed -i "/^\[extras\]/a baseurl=https://repo.almalinux.org/almalinux/${ALMA_VER}/extras/${ARCH}/os/" "$repofile"
-        fi
-      fi
+      done
     done
+    # Fallback: create override with same repo IDs (loads last via zz- prefix, overrides broken config)
+    if ! dnf makecache --quiet 2>/dev/null; then
+      echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] dnf makecache failed, creating AlmaLinux repo override" | tee -a /var/log/cyberpanel_upgrade_debug.log
+      cat > /etc/yum.repos.d/zz-almalinux-cyberpanel-fix.repo << EOF
+[baseos]
+name=AlmaLinux ${ALMA_VER} - BaseOS
+baseurl=${ALMA_BASE}/BaseOS/${ARCH}/os/
+enabled=1
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
+
+[appstream]
+name=AlmaLinux ${ALMA_VER} - AppStream
+baseurl=${ALMA_BASE}/AppStream/${ARCH}/os/
+enabled=1
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
+
+[extras]
+name=AlmaLinux ${ALMA_VER} - Extras
+baseurl=${ALMA_BASE}/extras/${ARCH}/os/
+enabled=1
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
+
+[crb]
+name=AlmaLinux ${ALMA_VER} - CRB
+baseurl=${ALMA_BASE}/CRB/${ARCH}/os/
+enabled=1
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
+EOF
+      dnf makecache --quiet 2>/dev/null || true
+    fi
   fi
   echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Setting up repositories for $Server_OS..." | tee -a /var/log/cyberpanel_upgrade_debug.log
   rm -f /etc/yum.repos.d/CyberPanel.repo
@@ -1365,7 +1398,7 @@ if [[ -f Makefile ]]; then
     # Replace -O0 -g3 with -O2 -g to satisfy _FORTIFY_SOURCE
     sed -i 's/-O0 -g3/-O2 -g/g' Makefile
     # Ensure we have proper optimization flags
-    if grep -q "CFLAGS" Makefile && ! grep -q -e "-O2" Makefile; then
+    if grep -q "CFLAGS" Makefile && ! grep -qF '-O2' Makefile; then
         sed -i 's/CFLAGS =/CFLAGS = -O2/' Makefile
     fi
     echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Makefile optimized for proper compilation" | tee -a /var/log/cyberpanel_upgrade_debug.log