diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 00000000..2502a94d
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,85 @@
+name: build
+
+on:
+  push:
+    branches:
+      - 'main'
+      - 'release/*'
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  DOCKERHUB_SLUG: distribution/distribution
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v3
+        with:
+          images: |
+            ${{ env.DOCKERHUB_SLUG }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=ref,event=pr
+            type=edge
+          labels: |
+            org.opencontainers.image.title=Distribution
+            org.opencontainers.image.description=The toolkit to pack, ship, store, and deliver container content
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Build artifacts
+        uses: docker/bake-action@v1
+        with:
+          targets: artifact-all
+      -
+        name: Move artifacts
+        run: |
+          mv ./bin/**/* ./bin/
+      -
+        name: Upload artifacts
+        uses: actions/upload-artifact@v2
+        with:
+          name: registry
+          path: ./bin/*
+          if-no-files-found: error
+      -
+        name: Build image
+        uses: docker/bake-action@v1
+        with:
+          files: |
+            ./docker-bake.hcl
+            ${{ steps.meta.outputs.bake-file }}
+          targets: image-all
+          push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
+      -
+        name: GitHub Release
+        uses: softprops/action-gh-release@v1
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          draft: true
+          files: |
+            bin/*.tar.gz
+            bin/*.zip
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
deleted file mode 100644
index 57482056..00000000
--- a/.github/workflows/release.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
-name: Release docker image
-
-on:
-  push:
-    tags:
-      - "*"
-
-jobs:
-  publish:
-    name: Build and publish docker image
-    runs-on: ubuntu-latest
-    env:
-      DOCKER_BUILDTAGS: "include_oss include_gcs"
-      CGO_ENABLED: 1
-      GO111MODULE: "auto"
-      GOPATH: ${{ github.workspace }}
-      GOOS: linux
-      COMMIT_RANGE: ${{ github.event_name == 'pull_request' && format('{0}..{1}',github.event.pull_request.base.sha, github.event.pull_request.head.sha) || format('{0}..{1}', github.event.before, github.event.after) }}
-
-    steps:
-      - name: Get git tag
-        id: get_git_tag
-        run: echo ::set-output name=git_tag::${GITHUB_REF#refs/tags/}
-
-      - name: Verify git tag
-        env:
-          GIT_TAG: ${{ steps.get_git_tag.outputs.git_tag }}
-        # NOTE: this is a simple Regexp, following the current versioning scheme
-        # In ideal world we should use this monstrosity:
-        # https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
-        run: |
-          [[ ${GIT_TAG} =~ ^v[0-9]+.[0-9]+.[0-9]+ ]]
-
-      - name: Check out source code
-        if: ${{ success() }}
-        uses: actions/checkout@v2
-        with:
-          ref: ${{ steps.get_git_tag.outputs.git_tag }}
-
-      - name: Set image tag
-        env:
-          GIT_TAG: ${{ steps.get_git_tag.outputs.git_tag }}
-        id: get_image_tag
-        run: echo ::set-output name=docker_tag::${GIT_TAG}
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Build and push
-        if: ${{ success() }}
-        uses: docker/build-push-action@v2
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64
-          push: true
-          tags: distribution/distribution:{{ steps.get_image_tag.outputs.docker_tag }}