diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index dda3a8c..3776305 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -16,6 +16,71 @@ jobs:
     - name: acceptance-test
       run: make docker-acceptance
 
+    - name: build-image
+      run: make docker-image
+
+    - name: save image
+      run: make save-image
+
+    - name: archive image
+      uses: actions/upload-artifact@v2
+      with:
+        name: kubeconform-image
+        path: kubeconform-image.tar
+
+  publish-image-master:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/master'
+    needs: test
+    steps:
+      - name: checkout
+        uses: actions/checkout@v2
+
+      - name: Download kubeconform image
+        uses: actions/download-artifact@v2
+        with:
+          name: kubeconform-image
+
+      - name: load image
+        run: docker load < kubeconform-image.tar
+
+      - name: push
+        run: |
+          echo "${{ github.token }}" | docker login https://docker.pkg.github.com -u ${GITHUB_ACTOR} --password-stdin
+          make push-image
+        env:
+          RELEASE_VERSION: master
+
+  publish-image-release:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: test
+    steps:
+      - name: checkout
+        uses: actions/checkout@v2
+
+      - name: Download kubeconform image
+        uses: actions/download-artifact@v2
+        with:
+          name: kubeconform-image
+
+      - name: load image
+        run: docker load < kubeconform-image.tar
+
+      - name: Set env
+        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
+
+      - name: push-tag
+        run: |
+          echo "${{ github.token }}" | docker login https://docker.pkg.github.com -u ${GITHUB_ACTOR} --password-stdin
+          make push-image
+
+      - name: push-latest
+        run: |
+          make push-image
+        env:
+          RELEASE_VERSION: latest
+
   goreleaser:
     runs-on: ubuntu-latest
     needs: test
diff --git a/Makefile b/Makefile
index 807557b..eee34b9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,7 @@
 #!/usr/bin/make -f
 
+RELEASE_VERSION ?= latest
+
 .PHONY: test-build test build build-static docker-test docker-build-static build-bats docker-acceptance docker-image release
 
 test-build: test build
@@ -11,10 +13,17 @@ build:
 	go build -o bin/ ./...
 
 docker-image:
-	docker build -t kubeconform .
+	docker build -t kubeconform:${RELEASE_VERSION} .
+
+save-image:
+	docker save --output kubeconform-image.tar kubeconform:${RELEASE_VERSION}
+
+push-image:
+	docker tag kubeconform:latest docker.pkg.github.com/yannh/kubeconform/kubeconform:${RELEASE_VERSION}
+	docker push docker.pkg.github.com/yannh/kubeconform/kubeconform:${RELEASE_VERSION}
 
 build-static:
-	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o bin/ ./...
+	CGO_ENABLED=0 GOFLAGS=-mod=vendor GOOS=linux GOARCH=amd64 GO111MODULE=on go build -trimpath -tags=netgo -ldflags "-extldflags=\"-static\""  -a -o bin/ ./...
 
 docker-test:
 	docker run -t -v $$PWD:/go/src/github.com/yannh/kubeconform -w /go/src/github.com/yannh/kubeconform golang:1.14 make test