diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
new file mode 100644
index 0000000..56be986
--- /dev/null
+++ b/.github/workflows/pipeline.yml
@@ -0,0 +1,27 @@
+name: Pipeline
+
+on:
+  push:
+    branches: [main]
+
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: oven-sh/setup-bun@v1
+
+      - run: bun install
+
+      # update npm for provenance support
+      - run: npm --version && npm install -g npm && npm --version
+
+      - run: bun test
+
+      - run: bun run build
+
+      - name: dry-publish
+        run: cd build && npm publish --provenance --dry-run
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..2ff52c2
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,31 @@
+name: Publish Package to NPM
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: oven-sh/setup-bun@v1
+
+      - run: bun install
+
+      # update npm for provenance support
+      - run: npm --version && npm install -g npm && npm --version
+
+      # make sure this publish doesn’t break anything
+      - run: bun test
+
+      - run: bun run build
+
+      - name: publish
+        run: cd build && npm publish --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
deleted file mode 100644
index 8dca693..0000000
--- a/.github/workflows/push.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-name: CI
-on: push
-jobs:
-  build-and-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: oven-sh/setup-bun@v1
-      - name: Install Dependencies
-        run: bun install
-      - name: Test bitwise
-        run: bun run test
-      - name: Build bitwise
-        run: bun run build
diff --git a/bun.lockb b/bun.lockb
index 93ecd69..0b93ea3 100755
Binary files a/bun.lockb and b/bun.lockb differ
diff --git a/package.json b/package.json
index 9f42fe4..29016e2 100644
--- a/package.json
+++ b/package.json
@@ -62,10 +62,7 @@
 	"scripts": {
 		"build": "rm -rf build && tsc && tsc -p ./tsconfig.treeshake.json && bun run build:copy",
 		"build:copy": "cp package.json build && cp readme.md build && cp license.md build",
-		"clean": "read -p \"Are you sure you want to discard all uncommitted changes? (y/n)\" CONTINUE; if [ \"$CONTINUE\" = \"y\" ]; then git clean -dxf; else exit 1; fi && bun install",
 		"coverage": "bun test --coverage",
-		"custom-publish": "bun run clean && bun run build && bun test && echo \"cd build && npm publish\"",
-		"postpublish": "git tag $(bun repl -p \"require('./package.json').version\") && git push --tags",
 		"test": "bun test",
 		"watch": "bun test --watch"
 	},