diff --git a/.cci.jenkinsfile b/.cci.jenkinsfile
index ff941249..af9faed5 100644
--- a/.cci.jenkinsfile
+++ b/.cci.jenkinsfile
@@ -4,6 +4,9 @@ stage("Build") {
   def n = 5
   buildPod(memory: "2Gi", cpu: "${n}") {
       checkout scm
+      stage("Static analysis") {
+          shwrap("./ci/codestyle.sh")
+      }
       stage("Core build") {
         shwrap("""
           # fetch tags so `git describe` gives a nice NEVRA when building the RPM
diff --git a/cfg.mk b/cfg.mk
index 471ccbc9..51e1833d 100644
--- a/cfg.mk
+++ b/cfg.mk
@@ -31,10 +31,6 @@ sc_glnx_errno_prefix_colon:
 	@prohibit='\<glnx_throw_errno_prefix *\(.*: ",' halt="don't add trailing : for glnx_throw_errno_prefix"	\
 	  $(_sc_search_regexp)
 
-sc_glnx_no_fd_close:
-	@prohibit='\<glnx_fd_close int' halt="Use glnx_autofd, not glnx_fd_close"	\
-	  $(_sc_search_regexp)
-
 #SHELL=bash -x
 show-vc-list-except:
 	@$(VC_LIST_EXCEPT)
diff --git a/ci/codestyle.sh b/ci/codestyle.sh
new file mode 100755
index 00000000..1cf0a23c
--- /dev/null
+++ b/ci/codestyle.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Tests that validate structure of the source code;
+# can be run without building it.
+set -euo pipefail
+
+# Don't hard require Rust
+if command -v cargo >/dev/null; then
+echo -n "checking rustfmt... "
+for crate in $(find -iname Cargo.toml); do
+    if ! cargo fmt --manifest-path ${crate} -- --check; then
+        echo "cargo fmt failed; run: cd $(dirname ${crate}) && cargo fmt" 1>&2
+        exit 1
+    fi
+done
+echo "ok"
+fi
+
+echo -n 'grep-based static analysis... '
+patterns=(glnx_fd_close)
+for pat in "${patterns[@]}"; do
+    if git grep "${pat}" | grep -v codestyle\.sh; then
+        echo "Files matched prohibited pattern: ${pat}" 1>&2
+        exit 1
+    fi
+done
+echo ok
diff --git a/ci/gh-build.sh b/ci/gh-build.sh
index fdc79569..48c16cda 100755
--- a/ci/gh-build.sh
+++ b/ci/gh-build.sh
@@ -26,6 +26,9 @@
 set -euo pipefail
 set -x
 
+# First, basic static analysis
+./ci/codestyle.sh
+
 NOCONFIGURE=1 ./autogen.sh
 
 srcdir="$(pwd)"