diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..aacfaab
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,102 @@
+name: Build distribution
+on:
+  pull_request:
+  release:
+    types:
+      - published
+
+permissions:
+  contents: read
+
+jobs:
+  build-artifacts:
+    runs-on: ubuntu-latest
+    if: github.repository == 'carbonplan/pangeo-forge-ndpyramid'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5.0.0
+        name: Install Python
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install setuptools setuptools-scm wheel twine check-manifest
+          git clean -xdf
+          git restore -SW .
+      # This step is only necessary for testing purposes and for TestPyPI
+      - name: Fix up version string for TestPyPI
+        if: ${{ !startsWith(github.ref, 'refs/tags') }}
+        run: |
+          # Change setuptools-scm local_scheme to "no-local-version" so the
+          # local part of the version isn't included, making the version string
+          # compatible with PyPI.
+          sed --in-place "s/guess-next-dev/no-local-version/g" pyproject.toml
+      - name: Build tarball and wheels
+        run: |
+          python -m build --sdist --wheel .
+      - name: Check built artifacts
+        run: |
+          python -m twine check --strict dist/*
+          pwd
+          if [ -f dist/pangeo-forge-ndpyramid-unknown.tar.gz ]; then
+            echo "❌ INVALID VERSION NUMBER"
+            exit 1
+          else
+            echo "✅ Looks good"
+          fi
+      - uses: actions/upload-artifact@v4
+        with:
+          name: releases
+          path: dist
+
+  test-built-dist:
+    needs: build-artifacts
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://test.pypi.org/p/pangeo-forge-ndpyramid
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/setup-python@v5.0.0
+        name: Install Python
+        with:
+          python-version: "3.12"
+      - uses: actions/download-artifact@v4
+        with:
+          name: releases
+          path: dist
+      - name: List contents of built dist
+        run: |
+          ls -ltrh
+          ls -ltrh dist
+      - name: Verify the built dist/wheel is valid
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install dist/pangeo-forge-ndpyramid*.whl
+          python -c "import pangeo-forge-ndpyramid; print(pangeo-forge-ndpyramid.__version__)"
+      - name: Publish package to TestPyPI
+        uses: pypa/gh-action-pypi-publish@v1.8.14
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          # verbose: true
+
+  upload-to-pypi:
+    needs: test-built-dist
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/p/pangeo-forge-ndpyramid
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: releases
+          path: dist
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@v1.8.14