diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..4327026
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,46 @@
+name: CI
+on:
+  push:
+    branches:
+      # Change this if your primary branch is not main
+      - main
+  pull_request:
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install pnpm
+        run: corepack enable pnpm
+      # Cache node_modules
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+      - run: pnpm i --frozen-lockfile
+      - uses: nrwl/nx-set-shas@v3
+      # This line is needed for nx affected to work when CI is running on a PR
+      - run: git branch --track main origin/main
+
+      - run: pnpm nx format:check
+      - run: pnpm nx affected -t lint,test,build --parallel=3
+      - name: Publish
+        run: |
+          npm config set provenance true
+          if git log -1 --pretty=%B | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+$";
+          then
+            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
+            pnpm nx run core:publish
+          elif git log -1 --pretty=%B | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+";
+          then
+            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
+            pnpm nx run core:publish --tag next
+          else
+            echo "Not a release, skipping publish"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
\ No newline at end of file
diff --git a/tools/scripts/publish.mjs b/tools/scripts/publish.mjs
index e3c5916..20fd003 100644
--- a/tools/scripts/publish.mjs
+++ b/tools/scripts/publish.mjs
@@ -22,13 +22,13 @@ function invariant(condition, message) {
 
 // Executing publish script: node path/to/publish.mjs {name} --version {version} --tag {tag}
 // Default "tag" to "next" so we won't publish the "latest" tag by accident.
-const [, , name, version, tag = "next"] = process.argv;
+const [, , name, version, tag] = process.argv;
 
 // A simple SemVer validation to validate the version
 const validVersion = /^\d+\.\d+\.\d+(-\w+\.\d+)?/;
 invariant(
-    version && validVersion.test(version),
-    `No version provided or version did not match Semantic Versioning, expected: #.#.#-tag.# or #.#.#, got ${version}.`
+    !version || validVersion.test(version),
+    `version did not match Semantic Versioning, expected: #.#.#-tag.# or #.#.#, got ${version}.`
 );
 
 const graph = readCachedProjectGraph();
@@ -46,15 +46,17 @@ invariant(
 );
 
 process.chdir(outputPath);
-
 // Updating the version in "package.json" before publishing
-try {
-    const json = JSON.parse(readFileSync(`package.json`).toString());
-    json.version = version;
-    writeFileSync(`package.json`, JSON.stringify(json, null, 2));
-} catch (e) {
-    console.error(`Error reading package.json file from library build output.`);
+if (version) {
+    try {
+        const json = JSON.parse(readFileSync(`package.json`).toString());
+        json.version = version;
+        writeFileSync(`package.json`, JSON.stringify(json, null, 2));
+    } catch (e) {
+        console.error(`Error reading package.json file from library build output.`);
+    }
 }
 
 // Execute "npm publish" to publish
-execSync(`npm publish --access public --tag ${tag}`);
+const tagArgs = tag ? `--tag ${tag}` : "";
+execSync(`npm publish --access public ${tagArgs}`);