diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..fada14c
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,46 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.22"
+          cache: true
+
+      - name: Run Go generators
+        run: go generate ./.../gen
+
+      - name: Ensure generated code is clean
+        run: git diff --exit-code
+
+      - name: Run Go vet
+        run: go vet ./...
+
+      - name: Build Go
+        run: go build ./...
+
+      - name: Run Go tests
+        run: go test ./...
+
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: Release ${{ github.ref_name }}
+          body: Release ${{ github.ref_name }}. See CHANGELOG.md for details.
diff --git a/README.adoc b/README.adoc
index f12eb4f..ec40a8d 100644
--- a/README.adoc
+++ b/README.adoc
@@ -28,7 +28,7 @@ go test ./...
 
 == Releases
 
-See link:RELEASE.md[Release guide] for versioning, tagging, and publishing steps.
+See link:RELEASE.md[Release guide] for versioning, tagging, and publishing steps. Pushing a `v*` tag on `main` runs the release workflow, which regenerates code, vets, tests, and publishes a GitHub release for that tag.
 
 == Directory structure
 
diff --git a/RELEASE.md b/RELEASE.md
index 84fa942..99f9736 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -16,4 +16,4 @@ Process for publishing tagged Go module releases for this fork of `keep-common`.
 ## Tagging & Publishing
 1) Tag: `git tag -a vX.Y.Z -m "Release vX.Y.Z"` (or `vX.Y.Z-tlabs.N` for fork-specific releases).
 2) Push tag: `git push origin vX.Y.Z[-tlabs.N]`.
-3) Create a GitHub release from the tag with the changelog excerpt and a note about the upstream baseline.
+3) CI: pushing a `v*` tag triggers the release workflow to regenerate code, run vet/tests, and publish a GitHub release with a placeholder body referencing `CHANGELOG.md`. Edit the GitHub release afterward to paste the changelog excerpt and upstream baseline notes.