diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..440f311
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,77 @@
+name: Release WatchVuln
+
+on:
+  push:
+    branches:
+      - 'release/**'
+      - 'main'
+  release:
+    types: [ published ]
+
+permissions:
+  contents: read
+
+jobs:
+  build-cli:
+    name: Build cli
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          - os: windows
+            arch: amd64
+            output: watchvuln-windows-amd64.exe
+          - os: darwin
+            arch: amd64
+            output: watchvuln-darwin-amd64
+          - os: darwin
+            arch: arm64
+            output: watchvuln-darwin-arm64
+          - os: linux
+            arch: amd64
+            output: watchvuln-linux-amd64
+          - os: linux
+            arch: arm64
+            output: watchvuln-linux-arm64
+    runs-on: ubuntu-latest
+    env:
+      CGO_ENABLED: 0
+      GOOS: ${{ matrix.os }}
+      GOARCH: ${{ matrix.arch }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
+      - uses: actions/setup-go@v3
+        with:
+          go-version: 1.19
+          cache: true
+      - run: go build -trimpath -ldflags "-w -s -extldflags '-static'" -o target/${{ matrix.output }}
+      - uses: actions/upload-artifact@v3
+        with:
+          name: target
+          path: target/*
+
+  collect-release:
+    name: Release
+    needs: [ build-cli ]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/download-artifact@v3
+        with:
+          name: target
+          path: target
+      - run: ls -al target && ls -R target/ && file target/
+      - uses: actions/upload-artifact@v3
+        with:
+          name: release-build
+          path: target/*
+
+      # release assets
+      - uses: softprops/action-gh-release@v1
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          files: target/*