diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b30130be..c4a19bc8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-name: CI
+name: ci
 
 on:
   push:
@@ -6,13 +6,12 @@ on:
       - main
   pull_request:
 
-permissions:
-  actions: read
-  contents: read
-
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with:
@@ -20,7 +19,7 @@ jobs:
 
       - run: corepack enable
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version-file: package.json
           cache: 'pnpm'
@@ -30,6 +29,8 @@ jobs:
 
       - run: pnpm i
 
+      - run: pnpm exec nx report
+
       - if: github.event_name == 'push'
         run: pnpm exec nx run tools-commitlint:exec:last
 
@@ -37,3 +38,6 @@ jobs:
         run: nx run tools-commitlint:exec:last --from ${{ github.event.pull_request.head.sha }}~${{ github.event.pull_request.commits }} --to ${{ github.event.pull_request.head.sha }}
 
       - run: pnpm exec nx affected -t lint test build
+
+      - if: github.event_name == 'push'
+        run: nx release --skip-publish
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 00000000..28e4ec36
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,36 @@
+name: publish
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - run: corepack enable
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: package.json
+          cache: 'pnpm'
+          cache-dependency-path: 'pnpm-lock.yaml'
+
+      - uses: nrwl/nx-set-shas@v4
+
+      - run: pnpm i
+
+      - run: pnpm exec nx report
+
+      - run: npx nx release publish --dry-run
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
diff --git a/nx.json b/nx.json
index 7a4412df..91d45275 100644
--- a/nx.json
+++ b/nx.json
@@ -12,13 +12,18 @@
       }
     },
     "changelog": {
-      "automaticFromRef": true
+      "automaticFromRef": true,
+      "workspaceChangelog": {
+        "renderOptions": {
+          "authors": false
+        }
+      }
     },
     "projects": ["packages/*"]
   },
   "namedInputs": {
     "default": ["{projectRoot}/**/*", "sharedGlobals"],
-    "sharedGlobals": []
+    "sharedGlobals": ["{workspaceRoot}/.github/workflows/ci.yml"]
   },
   "plugins": [
     {
@@ -35,6 +40,12 @@
     }
   ],
   "targetDefaults": {
+    "nx-release-publish": {
+      "options": {
+        "packageRoot": "dist/{projectRoot}"
+      },
+      "dependsOn": ["build"]
+    },
     "@nx/js:tsc": {
       "cache": true,
       "dependsOn": ["^build"],