diff --git a/.github/settings.yml b/.github/settings.yml
index bddbb4b..84a6313 100644
--- a/.github/settings.yml
+++ b/.github/settings.yml
@@ -12,5 +12,7 @@ branches:
     protection:
       required_status_checks:
         contexts:
+          - "build-cabal"
+          - "build-stack"
           - "cirrus-ci"
           - "code-review/reviewable"
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
new file mode 100644
index 0000000..e709fc3
--- /dev/null
+++ b/.github/workflows/checks.yml
@@ -0,0 +1,28 @@
+# WARNING: Actions in this file can access repository secrets. They should never
+# execute code of the pull request. All scripts should be fetched from merged
+# TokTok code.
+name: checks
+
+on:
+  pull_request_target:
+    branches: [master]
+
+jobs:
+  check-release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Checkout TokTok/ci-tools
+        uses: actions/checkout@v2
+        with:
+          repository: TokTok/ci-tools
+          path: ci-tools
+
+      - name: Check version against GitHub releases
+        env:
+          GH_USER: ${{ secrets.GH_USER }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+        run: $GITHUB_WORKSPACE/ci-tools/bin/check_release
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..8276bfb
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,65 @@
+name: ci
+
+on:
+  pull_request:
+    branches: [master]
+
+jobs:
+  build-cabal:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-haskell@v1
+        with:
+          ghc-version: "8.10.3"
+          cabal-version: "3.2"
+
+      - name: Cache
+        uses: actions/cache@v2
+        env:
+          cache-name: cache-cabal
+        with:
+          path: |
+            ~/.cabal/packages
+            ~/.cabal/store
+            dist-newstyle
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/*.cabal') }}
+          restore-keys: |
+            ${{ runner.os }}-build-${{ env.cache-name }}-
+            ${{ runner.os }}-build-
+            ${{ runner.os }}-
+
+      - name: Install non-Haskell dependencies
+        run: if [ -f tools/prepare_third_party.sh ]; then tools/prepare_third_party.sh; fi
+      - name: Run tests
+        run: cabal test --enable-doc all
+
+  build-stack:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-haskell@v1
+        with:
+          enable-stack: true
+          stack-version: "latest"
+
+      - name: Cache
+        uses: actions/cache@v2
+        env:
+          cache-name: cache-stack
+        with:
+          path: |
+            ~/.stack
+            .stack-work
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/*.cabal') }}
+          restore-keys: |
+            ${{ runner.os }}-build-${{ env.cache-name }}-
+            ${{ runner.os }}-build-
+            ${{ runner.os }}-
+
+      - name: Install non-Haskell dependencies
+        run: if [ -f tools/prepare_third_party.sh ]; then tools/prepare_third_party.sh; fi
+      - name: Run tests
+        run: stack test
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..b7da3af
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,54 @@
+name: publish
+
+on:
+  push:
+    branches: [master]
+  release:
+    types: [released]
+
+jobs:
+  hackage:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: Checkout TokTok/ci-tools
+        uses: actions/checkout@v2
+        with:
+          repository: TokTok/ci-tools
+          path: ci-tools
+
+      - uses: actions/setup-haskell@v1
+        with:
+          ghc-version: "8.10.3"
+          cabal-version: "3.2"
+
+      - name: Cache
+        uses: actions/cache@v2
+        env:
+          cache-name: cache-cabal
+        with:
+          path: |
+            ~/.cabal/packages
+            ~/.cabal/store
+            dist-newstyle
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/*.cabal') }}
+          restore-keys: |
+            ${{ runner.os }}-build-${{ env.cache-name }}-
+            ${{ runner.os }}-build-
+            ${{ runner.os }}-
+
+      - name: Build haddock documentation
+        run: cabal haddock --haddock-for-hackage --enable-doc
+
+      - name: Publish package candidate to Hackage
+        if: ${{ github.event_name == 'push' }}
+        env:
+          API_TOKEN_HACKAGE: ${{ secrets.API_TOKEN_HACKAGE }}
+        run: $GITHUB_WORKSPACE/ci-tools/bin/hackage_upload candidate
+
+      - name: Publish package to Hackage
+        if: ${{ github.event_name == 'release' }}
+        env:
+          API_TOKEN_HACKAGE: ${{ secrets.API_TOKEN_HACKAGE }}
+        run: $GITHUB_WORKSPACE/ci-tools/bin/hackage_upload
diff --git a/BUILD.bazel b/BUILD.bazel
index 0110026..c331449 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -3,7 +3,7 @@ load("@rules_haskell//haskell:defs.bzl", "haskell_library")
 load("//third_party/haskell/hspec-discover:build_defs.bzl", "hspec_test")
 load("//tools/project:build_defs.bzl", "project")
 
-project()
+project(custom_github = True)
 
 haskell_library(
     name = "hs-github-tools",
diff --git a/stack.yaml b/stack.yaml
index 9779620..6a9e92c 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -2,4 +2,6 @@
 packages: [.]
 resolver: lts-18.18
 extra-deps:
+  - base16-bytestring-0.1.1.7@sha256:0021256a9628971c08da95cb8f4d0d72192f3bb8a7b30b55c080562d17c43dd3,2231
   - github-0.26@sha256:a9d4046325c3eb28cdc7bef2c3f5bb213328caeae0b7dce6f51de655f0bffaa1,7162
+  - http-link-header-1.0.3.1@sha256:9917c26635a46eff5d36c5344a4ae42fad2b5de79c0e300363bddd5eec66facd,1937