diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..e051d1f
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,25 @@
+name: Release
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*.*.*'
+
+jobs:
+  release-next-container:
+    uses: radiorabe/actions/.github/workflows/release-container.yaml@v0.24.0
+    with:
+      image: 'ghcr.io/radiorabe/website-stack/next'
+      name: 'next'
+      display-name: 'RaBe Nextjs Website'
+      tags: 'rabe web nextjs alpine'
+      # the alpine base image used for the nextjs frontend does not have a
+      # keyless cosign signature, so we disable verifying the image.
+      cosign-verify: false
+      context: './next/'
+      dockerfile: './next/Dockerfile.prod'
+      build-args: |
+        IMAGES_HOSTNAME=*.rabe.ch
diff --git a/.github/workflows/schedule.yaml b/.github/workflows/schedule.yaml
new file mode 100644
index 0000000..338c7c4
--- /dev/null
+++ b/.github/workflows/schedule.yaml
@@ -0,0 +1,12 @@
+name: Scheduled tasks
+
+on:
+  schedule:
+    - cron:  '13 12 * * *'
+  workflow_dispatch:
+
+jobs:
+  schedule-trivy:
+    uses: radiorabe/actions/.github/workflows/schedule-trivy.yaml@v0.24.0
+    with:
+      image-ref: 'ghcr.io/radiorabe/website-stack/next:latest'
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
new file mode 100644
index 0000000..40accd1
--- /dev/null
+++ b/.github/workflows/test.yaml
@@ -0,0 +1,41 @@
+name: Test
+
+on:
+  pull_request:
+
+env:
+  IMAGES_HOSTNAME: "*"
+
+jobs:
+  next-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup node
+        uses: actions/setup-node@v2
+        with:
+          node-version: 22
+          cache: yarn
+          cache-dependency-path: next/yarn.lock
+
+      - name: Install eslint (for easier rebasing, could be added to packages.json later)
+        working-directory: ./next
+        run: yarn add --dev eslint-config-next 'eslint@^8'
+
+      - name: Install dependencies
+        working-directory: ./next
+        run: yarn install --frozen-lockfile
+
+      - name: Running linter
+        working-directory: ./next
+        run: yarn run next lint --output-file ../next-eslint_report.json --format json
+        continue-on-error: true
+
+      - name: Annotate Code Linting Results
+        uses: ataylorme/eslint-annotate-action@v3
+        with:
+          report-json: "next-eslint_report.json"
+          only-pr-files: false
+        continue-on-error: true
diff --git a/next/.eslintrc.json b/next/.eslintrc.json
new file mode 100644
index 0000000..408e9bf
--- /dev/null
+++ b/next/.eslintrc.json
@@ -0,0 +1,3 @@
+{
+  "extends": ["next", "next/typescript"]
+}
diff --git a/next/Dockerfile.prod b/next/Dockerfile.prod
index 36923cd..608fd8d 100644
--- a/next/Dockerfile.prod
+++ b/next/Dockerfile.prod
@@ -20,6 +20,12 @@ RUN \
 
 # Rebuild the source code only when needed
 FROM base AS builder
+
+# defaults for use during the container build phase on CI/CD
+ARG IMAGES_PROTOCOL=https
+ARG IMAGES_HOSTNAME=**
+ARG IMAGES_PORT=433
+
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
diff --git a/next/package.json b/next/package.json
index 16a8319..a33f390 100644
--- a/next/package.json
+++ b/next/package.json
@@ -2,6 +2,7 @@
   "private": true,
   "scripts": {
     "dev": "next dev",
+    "lint": "next lint",
     "build": "next build",
     "start": "node .next/standalone/server.js",
     "syncDataModel": "node bin/syncDataModel.js",