diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..57de95e
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,95 @@
+name: Build
+
+on: push
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: false
+      - name: Lint
+        uses: golangci/golangci-lint-action@v6
+
+  test:
+    name: Test
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Test
+        run: go test ./...
+
+  build:
+    name: Build
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Set build variables
+        id: vars
+        run: |
+          args='release --clean'
+          if [[ "$GITHUB_REF" != refs/tags/* ]]; then
+            args+=' --snapshot'
+          fi
+          echo "args=$args" >> $GITHUB_OUTPUT
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: v2
+          args: ${{ steps.vars.outputs.args }}
+      - name: Push beta image
+        if: github.ref_name == 'main'
+        run: |
+          export REPO="$(tr '[[:upper:]]' '[[:lower:]]' <<< "ghcr.io/$GITHUB_REPOSITORY")"
+          IMAGES=()
+          while read -r SOURCE DEST; do
+            docker tag "$SOURCE" "$DEST"
+            docker push "$DEST"
+            IMAGES+=("$DEST")
+          done \
+            < <(docker image ls --format=json | \
+              yq --input-format=json --output-format=tsv '
+                select(.Repository == strenv(REPO)) |
+                [
+                  .Repository + ":" + .Tag,
+                  .Repository + ":beta-" + (.Tag | sub(".*-", ""))
+                ]
+              ')
+
+          docker manifest create "$REPO:beta" "${IMAGES[@]}"
+          docker manifest push "$REPO:beta"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist