diff --git a/.gitea/workflows/_diag.yml b/.gitea/workflows/_diag.yml
new file mode 100644
index 0000000..641752d
--- /dev/null
+++ b/.gitea/workflows/_diag.yml
@@ -0,0 +1,23 @@
+name: _diag runner net
+on:
+  workflow_dispatch:
+jobs:
+  diag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: env and dns probe
+        shell: bash
+        run: |
+          echo "RESULTS_URL=${ACTIONS_RESULTS_URL:-<unset>}"
+          echo "RUNTIME_URL=${ACTIONS_RUNTIME_URL:-<unset>}"
+          echo "CACHE_URL=${ACTIONS_CACHE_URL:-<unset>}"
+          echo "RUNNER_VERSION=${GITEA_ACTIONS_RUNNER_VERSION:-<unset>}"
+          echo "HTTP_PROXY=${HTTP_PROXY:-} HTTPS_PROXY=${HTTPS_PROXY:-} NO_PROXY=${NO_PROXY:-}"
+          echo "---- /etc/hosts"; cat /etc/hosts
+          echo "---- /etc/resolv.conf"; cat /etc/resolv.conf
+          for u in "$ACTIONS_RESULTS_URL" "$ACTIONS_RUNTIME_URL"; do
+            h=$(echo "$u" | sed -E 's#^[a-zA-Z]+://##; s#[/:].*$##')
+            echo "==== probe host: $h (from $u)"
+            getent hosts "$h" || echo "getent FAILED"
+            curl -sS -m 8 -o /dev/null -w "http_code=%{http_code} time=%{time_total}\n" "$u" || echo "curl FAILED rc=$?"
+          done