diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..a0631c0
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - develop
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm gate
+      - name: Publish preview
+        if: github.event_name == 'pull_request' || github.ref == 'refs/heads/develop'
+        run: pnpx pkg-pr-new publish ./packages/roller --compact --pnpm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..9effe18
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,31 @@
+name: Release
+
+on:
+  release:
+    types:
+      - published
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm gate
+      - run: pnpm publish --access public --provenance --no-git-checks
+        working-directory: packages/roller
diff --git a/README.md b/README.md
index b3ff006..be9530c 100644
--- a/README.md
+++ b/README.md
@@ -75,3 +75,13 @@ than adding a restore event.
 DSH has no UI-less command entry point, so command execution is exercised
 end-to-end by dashi while roller's own profile smoke covers installation and
 startup.
+
+## Development
+
+Work branches open pull requests against the integration branch, `develop`;
+`main` contains releases. Pull requests and pushes to `develop` publish
+installable previews through pkg.pr.new once its GitHub App is installed.
+
+To release, update the version and changelog on `develop`, merge it to `main`,
+tag the release as `vX.Y.Z`, and publish a matching GitHub release. The release
+workflow runs the full gate before publishing to npm with trusted publishing.
diff --git a/packages/roller/package.json b/packages/roller/package.json
index 8202bc1..5e1680b 100644
--- a/packages/roller/package.json
+++ b/packages/roller/package.json
@@ -7,9 +7,13 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://forgejo.antst.net/ai/roller.git",
+    "url": "https://github.com/antst/roller",
     "directory": "packages/roller"
   },
+  "homepage": "https://github.com/antst/roller#readme",
+  "bugs": {
+    "url": "https://github.com/antst/roller/issues"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",