diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 1c5c448..551980b 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -1,7 +1,11 @@
 # copy from: https://github.com/frankie567/httpx-ws/blob/main/.github/workflows/docs.yml
 
-name: Build documentation
+name: Deploy documentation
 
+
+# Since document updates may be frequent,
+# we do not run tests when deploying documents,
+# instead test during the PR stage.
 on:
   push:
     branches:
@@ -19,7 +23,7 @@ defaults:
     shell: bash
 
 jobs:
-  build:
+  build-docs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -41,8 +45,8 @@ jobs:
         with:
           path: ./site
 
-  deploy:
-    needs: build
+  deploy-docs:
+    needs: build-docs
     # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
     permissions:
       pages: write # to deploy to Pages
diff --git a/.github/workflows/lint-test.yml b/.github/workflows/lint-test.yml
index b6bbeeb..7bc4baf 100644
--- a/.github/workflows/lint-test.yml
+++ b/.github/workflows/lint-test.yml
@@ -1,11 +1,17 @@
+# WARNING: Do not change the name of this file, keep `lint-test.yml`.
+
 name: Lint check and test
 
+
+# We only automatically run checks for PRs.
+# It is best to avoid direct commits to the main branch, instead make a PR for checks.
+# For the pushes to the main branch, the checks is done by `publish.yml` when publish.
 on:
-  push:
-    branches: ["main"]
   pull_request:
-    branches: ["main"]
   workflow_dispatch:
+  # NOTE: set `secrets: inherit` when call this workflow from other workflow.
+  workflow_call:
+
 
 jobs:
   lint-check:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..66e04e9
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,80 @@
+# refer to: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
+
+name: Publish Python 🐍 distribution 📦 to PyPI and TestPyPI
+
+# NOTE: We do not restrict branches here,
+# instead restrict branches in the `environment` - `pypi`.
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  lint-test:
+    name: Lint check and test 🧪
+    uses: ./.github/workflows/lint-test.yml
+    secrets: inherit # IMPORTANT: sub-workflow needs secrets for uploading codecov
+
+  build-dist:
+    needs:
+      - lint-test
+    name: Build distribution 📦
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install hatch
+      - name: Build a binary wheel and a source tarball
+        run: |
+          hatch build
+      - name: Store the distribution packages
+        uses: actions/upload-artifact@v3
+        with:
+          name: python-package-distributions
+          path: dist/
+          if-no-files-found: error
+
+  publish-to-pypi:
+    needs:
+      - build-dist
+    name: Publish Python 🐍 distribution 📦 to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/fastapi-proxy-lib
+    permissions:
+      id-token: write # IMPORTANT: mandatory for trusted publishing
+    steps:
+      - name: Download all the dists
+        uses: actions/download-artifact@v3
+        with:
+          name: python-package-distributions
+          path: dist/
+      - name: Publish distribution 📦 to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  github-release:
+    needs:
+      - publish-to-pypi
+    name: Create GitHub release 🏷️
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # IMPORTANT: mandatory for creating release
+    steps:
+      - name: Download all the dists
+        uses: actions/download-artifact@v3
+        with:
+          name: python-package-distributions
+          path: dist/
+      - name: Create release
+        uses: ncipollo/release-action@v1
+        with:
+          draft: true
+          body: ${{ github.event.head_commit.message }}
+          artifacts: dist/*.whl,dist/*.tar.gz