diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..b4ee6e5
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,40 @@
+---
+name: ci
+
+on:
+  push:
+    branches: 
+      - main
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  run:
+    strategy:
+      fail-fast: false
+      matrix:
+        goal: ['build', 'test']
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - run: make ${{ matrix.goal }}
+
+  snapshot:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          distribution: goreleaser
+          version: "1.6.3"
+          args: release --snapshot --skip-publish --rm-dist
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index 6fa8391..5b71f4f 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -11,12 +11,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
       - name: install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v6
         with:
-          go-version-file: .go-version
+          go-version-file: go.mod
 
       - name: check go.mod
         # tidy go mod and check for differences
@@ -26,12 +26,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
       - name: install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v6
         with:
-          go-version-file: .go-version
+          go-version-file: go.mod
 
       - name: check format
         # exit with 0 only if gofmt returns 0 lines
@@ -41,12 +41,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
       - name: install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v6
         with:
-          go-version-file: .go-version
+          go-version-file: go.mod
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v2
@@ -72,12 +72,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
       - name: install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v6
         with:
-          go-version-file: .go-version
+          go-version-file: go.mod
 
       - name: check license
         # -d returns files without proper header
@@ -89,12 +89,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
       - name: install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v6
         with:
-          go-version-file: .go-version
+          go-version-file: go.mod
 
       - name: check fragments
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..ddc8967
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,38 @@
+name: release
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  attestations: write
+  contents: write
+  id-token: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      # IMPORTANT: the secrets below are managed through IASC (contact robots if you need further assistance)
+      - name: Log in to the Elastic Container registry
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        with:
+          registry: ${{ secrets.ELASTIC_DOCKER_REGISTRY }}
+          username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
+          password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}
+
+      - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          distribution: goreleaser
+          version: "1.6.3"
+          args: release --clean