diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
new file mode 100644
index 0000000..2f54b16
--- /dev/null
+++ b/.github/workflows/check.yml
@@ -0,0 +1,17 @@
+name: Check
+
+on:
+  pull_request:
+    branches:
+      - master
+      - devel
+  # XXX for testing
+  push:
+    branches:
+      - ci/gha
+
+jobs:
+  check:
+    uses: wetransform/gha-workflows/.github/workflows/gradle-library-check.yml@master
+    with:
+      java-version: 17
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..2f02896
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,34 @@
+name: Publish
+
+on:
+  push:
+    branches:
+      - devel
+      - master
+  workflow_dispatch: {}
+
+concurrency:
+  # only run one publishing at a time to avoid conflicts in artifactory
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  artifacts:
+    uses: wetransform/gha-workflows/.github/workflows/gradle-library.yml@master
+    with:
+      java-version: 17
+      gradle-tasks: clean check distZip buildDeb publish
+      upload-artifact-path: build/distributions
+      upload-artifact-name: distributions
+    secrets:
+      SLACK_NOTIFICATIONS_BOT_TOKEN: ${{ secrets.SLACK_NOTIFICATIONS_BOT_TOKEN }}
+
+  docker:
+    uses: wetransform/gha-workflows/.github/workflows/gradle-service-publish.yml@master
+    with:
+      java-version: 17
+      image-tag: wetransform/hale-cli:latest
+    secrets:
+      DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      SLACK_NOTIFICATIONS_BOT_TOKEN: ${{ secrets.SLACK_NOTIFICATIONS_BOT_TOKEN }}