diff --git a/.github/workflows/build-publish.yml b/.github/workflows/build-publish.yml
new file mode 100644
index 0000000..94dbac2
--- /dev/null
+++ b/.github/workflows/build-publish.yml
@@ -0,0 +1,54 @@
+name: build & publish Docker image
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  lint-test:
+    name: lint & test
+    uses: './.github/workflows/test.yml'
+
+  build-publish:
+    name: build & publish Docker image
+    needs:
+      - lint-test
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    steps:
+    - name: checkout
+      uses: actions/checkout@v4
+
+    - name: log into the GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
+
+    - name: compute Docker image OCI metadata from commit & repo
+      id: docker-metadata
+      uses: docker/metadata-action@v5
+      with:
+        labels: |
+          org.opencontainers.image.version=${{ github.ref_name }}
+
+    - name: set up Docker buildx
+      uses: docker/setup-buildx-action@v3
+    - name: set up QEMU for cross-platform builds
+      uses: docker/setup-qemu-action@v3
+
+    - name: build and push Docker image
+      uses: docker/build-push-action@v5
+      with:
+        push: true
+        tags: |
+          ghcr.io/${{ github.repository }}:latest
+          ghcr.io/${{ github.repository }}:${{ github.ref_name }}
+        labels: ${{ steps.docker-metadata.outputs.labels }}
+        platforms: linux/amd64,linux/arm64
+        # https://docs.docker.com/build/ci/github-actions/cache/#cache-backend-api
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e923a1b..cc2b65b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,4 +1,4 @@
-name: test
+name: lint & test
 
 on:
   push:
@@ -7,6 +7,8 @@ on:
   pull_request:
     branches:
       - '*'
+  # make this workflow callable from other workflows
+  workflow_call:
 
 jobs:
   test: