diff --git a/.cci.jenkinsfile b/.cci.jenkinsfile
index ff941249..af9faed5 100644
--- a/.cci.jenkinsfile
+++ b/.cci.jenkinsfile
@@ -4,6 +4,9 @@ stage("Build") {
   def n = 5
   buildPod(memory: "2Gi", cpu: "${n}") {
       checkout scm
+      stage("Static analysis") {
+          shwrap("./ci/codestyle.sh")
+      }
       stage("Core build") {
         shwrap("""
           # fetch tags so `git describe` gives a nice NEVRA when building the RPM
diff --git a/Makefile.am b/Makefile.am
index 6eb88388..4e669164 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -41,6 +41,9 @@ AM_DISTCHECK_CONFIGURE_FLAGS += \
 
 GITIGNOREFILES = aclocal.m4 build-aux/ buildutil/*.m4 config.h.in gtk-doc.make
 
+# Generated by ci/gh-build.sh
+GITIGNOREFILES += ci-build/
+
 # Generated by coreos-assembler build-fast and kola
 GITIGNOREFILES += fastbuild-*.qcow2 _kola_temp/
 
diff --git a/cfg.mk b/cfg.mk
index 471ccbc9..51e1833d 100644
--- a/cfg.mk
+++ b/cfg.mk
@@ -31,10 +31,6 @@ sc_glnx_errno_prefix_colon:
 	@prohibit='\<glnx_throw_errno_prefix *\(.*: ",' halt="don't add trailing : for glnx_throw_errno_prefix"	\
 	  $(_sc_search_regexp)
 
-sc_glnx_no_fd_close:
-	@prohibit='\<glnx_fd_close int' halt="Use glnx_autofd, not glnx_fd_close"	\
-	  $(_sc_search_regexp)
-
 #SHELL=bash -x
 show-vc-list-except:
 	@$(VC_LIST_EXCEPT)
diff --git a/ci/codestyle.sh b/ci/codestyle.sh
new file mode 100755
index 00000000..1cf0a23c
--- /dev/null
+++ b/ci/codestyle.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Tests that validate structure of the source code;
+# can be run without building it.
+set -euo pipefail
+
+# Don't hard require Rust
+if command -v cargo >/dev/null; then
+echo -n "checking rustfmt... "
+for crate in $(find -iname Cargo.toml); do
+    if ! cargo fmt --manifest-path ${crate} -- --check; then
+        echo "cargo fmt failed; run: cd $(dirname ${crate}) && cargo fmt" 1>&2
+        exit 1
+    fi
+done
+echo "ok"
+fi
+
+echo -n 'grep-based static analysis... '
+patterns=(glnx_fd_close)
+for pat in "${patterns[@]}"; do
+    if git grep "${pat}" | grep -v codestyle\.sh; then
+        echo "Files matched prohibited pattern: ${pat}" 1>&2
+        exit 1
+    fi
+done
+echo ok
diff --git a/ci/fah29-insttests.sh b/ci/fah29-insttests.sh
deleted file mode 100755
index a045cf52..00000000
--- a/ci/fah29-insttests.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/bash
-set -xeuo pipefail
-
-./tests/installed/provision.sh
-# TODO: enhance papr to have caching, a bit like https://docs.travis-ci.com/user/caching/
-cd tests/installed
-curl -Lo fedora-atomic-host.qcow2 https://getfedora.org/atomic_qcow2_latest
-exec env "TEST_SUBJECTS=$(pwd)/fedora-atomic-host.qcow2" ./run.sh
diff --git a/ci/gh-build.sh b/ci/gh-build.sh
index fdc79569..48c16cda 100755
--- a/ci/gh-build.sh
+++ b/ci/gh-build.sh
@@ -26,6 +26,9 @@
 set -euo pipefail
 set -x
 
+# First, basic static analysis
+./ci/codestyle.sh
+
 NOCONFIGURE=1 ./autogen.sh
 
 srcdir="$(pwd)"
diff --git a/ci/provision-prep.sh b/ci/provision-prep.sh
deleted file mode 100755
index 96a2041e..00000000
--- a/ci/provision-prep.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/bash
-# Prepare the current environment
-
-set -xeuo pipefail
-
-dn=$(dirname $0)
-. ${dn}/libbuild.sh
-pkg_upgrade
-pkg_install_buildroot
-pkg_install sudo which attr fuse strace \
-            libubsan libasan libtsan PyYAML elfutils
-pkg_install_if_os fedora gjs gnome-desktop-testing parallel coccinelle clang
-
-if test -n "${CI_PKGS:-}"; then
-    pkg_install ${CI_PKGS}
-fi