diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index b041f167..d0b89a33 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -49,4 +49,28 @@ jobs:
     - run: deno task check
     - run: deno task check
       working-directory: ${{ github.workspace }}/examples/blog/
-    - run: deno publish --dry-run
+    - run: deno task publish --dry-run
+
+  publish:
+    if: github.event_name == 'push'
+    needs: [test, lint]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+    - uses: actions/checkout@v4
+    - uses: denoland/setup-deno@v1
+      with:
+        deno-version: v1.x
+    - if: github.ref_type == 'branch'
+      run: |
+        jq \
+          --arg build "$GITHUB_RUN_NUMBER" \
+          --arg commit "${GITHUB_SHA::8}" \
+          '.version = .version + "-dev." + $build + "+" + $commit' \
+          deno.json > deno.json.tmp
+        mv deno.json.tmp deno.json
+    - if: github.ref_type == 'tag'
+      run: '[[ "$(jq .version deno.json)" = "$GITHUB_REF_NAME" ]]'
+    - run: deno task publish
diff --git a/deno.json b/deno.json
index 5a06a7d6..45fa1795 100644
--- a/deno.json
+++ b/deno.json
@@ -18,7 +18,8 @@
     "check": "deno task codegen && deno fmt --check && deno lint && deno check */*.ts",
     "codegen": "deno run --allow-read --allow-write --check codegen/main.ts vocab/ ../runtime/ > vocab/vocab.ts && deno fmt vocab/vocab.ts && deno cache vocab/vocab.ts && deno check vocab/vocab.ts",
     "test-without-codegen": "deno test --check --doc --allow-read --allow-write --unstable-temporal",
-    "test": "deno task codegen && deno task test-without-codegen"
+    "test": "deno task codegen && deno task test-without-codegen",
+    "publish": "deno task codegen && deno publish"
   },
   "unstable": [
     "temporal"