diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..4f5d81c
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  check:
+    name: Check
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo build --release
+      - run: cargo test
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy -- -D warnings
+      - run: cargo fmt --check
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..4be9118
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,46 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-latest
+          - target: x86_64-apple-darwin
+            os: macos-latest
+          - target: aarch64-apple-darwin
+            os: macos-latest
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo build --release --target ${{ matrix.target }}
+      - name: Package (Unix)
+        if: runner.os != 'Windows'
+        run: |
+          cd target/${{ matrix.target }}/release
+          tar czf ../../../fledge-plugin-gitleaks-${{ matrix.target }}.tar.gz fledge-gitleaks
+      - name: Package (Windows)
+        if: runner.os == 'Windows'
+        run: |
+          cd target/${{ matrix.target }}/release
+          7z a ../../../fledge-plugin-gitleaks-${{ matrix.target }}.zip fledge-gitleaks.exe
+      - uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            fledge-plugin-gitleaks-*.tar.gz
+            fledge-plugin-gitleaks-*.zip
diff --git a/src/main.rs b/src/main.rs
index a8c561c..2109c92 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -85,7 +85,11 @@ fn run_scan(staged: bool, strict: bool) -> Result<bool> {
     let version = require_gitleaks()?;
 
     let cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
-    let mode = if staged { "staged changes" } else { "working tree" };
+    let mode = if staged {
+        "staged changes"
+    } else {
+        "working tree"
+    };
     println!("scanning {} in {}", mode, cwd.display());
     println!("  using gitleaks {version}");
 
@@ -161,7 +165,12 @@ fn print_findings(findings: &[Finding], strict: bool) {
         let location = if f.commit.is_empty() {
             format!("{}:{}", f.file, f.start_line)
         } else {
-            format!("{}:{} ({})", f.file, f.start_line, &f.commit[..7.min(f.commit.len())])
+            format!(
+                "{}:{} ({})",
+                f.file,
+                f.start_line,
+                &f.commit[..7.min(f.commit.len())]
+            )
         };
         println!("  - [{}] {}", f.rule_id, location);
         println!("      {}", f.description);
@@ -250,7 +259,9 @@ fn uninstall_hook() -> Result<()> {
 #[cfg(unix)]
 fn make_executable(path: &Path) -> Result<()> {
     use std::os::unix::fs::PermissionsExt;
-    let mut perms = fs::metadata(path).context("reading hook permissions")?.permissions();
+    let mut perms = fs::metadata(path)
+        .context("reading hook permissions")?
+        .permissions();
     perms.set_mode(0o755);
     fs::set_permissions(path, perms).context("setting hook permissions")?;
     Ok(())