diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 00000000..e2720c3a
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,95 @@
+name: Release CLI
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+env:
+  PACT_VERSION: ${{ github.sha }}
+  PACT_BROKER_BASE_URL: ${{ secrets.PACT_BROKER_BASE_URL }}
+  PACT_BROKER_TOKEN: ${{ secrets.PACT_BROKER_TOKEN }}
+
+# many jobs copied from main.yml because GHA has no way to create cross-workflow dependencies
+# and no really rock-solid way to use an `if` property to limit to tag creation
+jobs:
+  make-tests:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v3
+        with:
+          go-version: '^1.20'
+      - uses: replicatedhq/action-install-pact@v1
+      - run: make test
+      - run: make publish-pact
+  make-build:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v3
+      - name: make build
+        run: make build
+  create-release:
+    runs-on: ubuntu-20.04
+    needs:
+      - make-tests
+      - make-build
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '^1.20'
+      - name: docker login
+        run:  docker login -u="$DOCKERHUB_DOCKER_USER" -p="$DOCKERHUB_DOCKER_PASS"
+        env:
+          DOCKERHUB_DOCKER_USER: ${{ secrets.DOCKERHUB_USER }}
+          DOCKERHUB_DOCKER_PASS: ${{ secrets.DOCKERHUB_PASSWORD }}
+      - uses: replicatedhq/action-install-pact@v1
+      - run: make can-i-deploy
+      - name: run goreleaser
+        run: curl -sL https://git.io/goreleaser | VERSION=v2.3.2 bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
+      - run: make record-release
+      - name: get previous release sha
+        id: previous-release
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const {
+              data: [latest, previous],
+            } = await github.rest.repos.listReleases({
+              ...context.repo,
+              per_page: 2,
+              page: 1,
+            });
+            if (!previous) return;
+            const {
+              data: {
+                object: { sha, type },
+              },
+            } = await github.rest.git.getRef({
+              ...context.repo,
+              ref: `tags/${previous.tag_name}`,
+            });
+            if (type === "commit") {
+              core.setOutput("sha", sha);
+              return;
+            } else {
+              const {
+                data: {
+                  object: { sha: actual_sha },
+                },
+              } = await github.rest.git.getTag({
+                ...context.repo,
+                tag_sha: sha,
+              });
+              core.setOutput("sha", actual_sha);
+            }
+      - if: steps.previous-release.outputs.sha
+        env:
+          PACT_VERSION: ${{ steps.previous-release.outputs.sha }}
+        run: make record-support-ended