diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index 2667f38..0000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,69 +0,0 @@
-# Javascript Node CircleCI 2.0 configuration file
-#
-# Check https://circleci.com/docs/2.0/language-javascript/ for more details
-#
-version: 2
-jobs:
-  test:
-    docker:
-      # specify the version you desire here
-      - image: cimg/node:20.5.0-browsers
-
-    working_directory: ~/repo
-
-    steps:
-      - checkout
-
-      # Download and cache dependencies
-      - restore_cache:
-          keys:
-            - v1-dependencies-{{ checksum "package-lock.json" }}
-
-      - run: npm install
-
-      - save_cache:
-          paths:
-            - node_modules
-          key: v1-dependencies-{{ checksum "package-lock.json" }}
-
-      # run tests!
-      - run: npx tsc --version
-      - run: npm run lint
-      - run: npm run build
-      #- run: npm run test
-
-  publish-translations:
-    docker:
-      # specify the version you desire here
-      - image: cimg/node:20.5.0-browsers
-
-    working_directory: ~/repo
-
-    steps:
-      - checkout
-
-      # Download and cache dependencies
-      - restore_cache:
-          keys:
-            - v1-dependencies-{{ checksum "package-lock.json" }}
-            # fallback to using the latest cache if no exact match is found
-            - v1-dependencies-
-
-      - run: npm run build
-      - run: sudo apt-get update && sudo apt-get install -y awscli
-      - run: AWS_SECRET_ACCESS_KEY=$S3_AWS_SECRET_ACCESS_KEY AWS_ACCESS_KEY_ID=$S3_AWS_ACCESS_KEY_ID aws s3 sync dist/ "s3://$S3_BUCKET/native/translations" --acl public-read --content-type "application/javascript;charset=utf-8"
-
-
-
-workflows:
-    version: 2
-    test-and-maybe-publish:
-      jobs:
-        - test
-        - publish-translations:
-            requires:
-              - test
-            filters:
-              branches:
-                only: master
-
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index b06f470..ac90fbb 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -1,21 +1,21 @@
-name: "Lint PR"
+name: pr
+on: [pull_request]
 
-on:
-  pull_request_target:
-    types:
-      - opened
-      - edited
-      - synchronize
-      - reopened
-
-permissions:
-  pull-requests: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  main:
-    name: Validate PR title
+  # build all assets for CI context
+  build:
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: "npm"
+      - run: npm ci
+      - run: npx tsc --version
+      - run: npm run lint
+      - run: npm run build
diff --git a/.github/workflows/prereleased.yml b/.github/workflows/prereleased.yml
new file mode 100644
index 0000000..6e8de2b
--- /dev/null
+++ b/.github/workflows/prereleased.yml
@@ -0,0 +1,13 @@
+name: prereleased
+on:
+  release:
+    types: [prereleased]
+
+jobs:
+  release-canary:
+    uses: ./.github/workflows/release-channel.yml
+    with:
+      channel: canary
+      tag: ${{ github.event.release.tag_name }}
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/release-channel.yml b/.github/workflows/release-channel.yml
new file mode 100644
index 0000000..103625b
--- /dev/null
+++ b/.github/workflows/release-channel.yml
@@ -0,0 +1,72 @@
+name: release-channel
+on:
+  workflow_call:
+    secrets:
+      NPM_TOKEN:
+        required: false # not needed for dry runs
+    inputs:
+      tag:
+        required: true
+        type: string
+        description: the release tag to publish to npm (e.g. v2.7.0)
+      channel:
+        required: true
+        type: string
+        description: the channel canary|stable to publish to
+      dry_run:
+        required: false
+        type: boolean
+        description: pack and validate everything without publishing to npm
+        default: false
+
+  workflow_dispatch:
+    inputs:
+      tag:
+        required: true
+        type: string
+        description: the release tag to publish to npm (e.g. v2.7.0)
+      channel:
+        required: true
+        type: choice
+        options:
+          - canary
+          - stable
+        description: the channel canary|stable to publish to
+      dry_run:
+        required: false
+        type: boolean
+        description: pack and validate everything without publishing to npm
+        default: false
+
+jobs:
+  npm-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
+      - name: confirm package.json version matches tag
+        run: |
+          version=$(jq -r '.version' package.json)
+          tag_version="${TAG#v}"
+          echo "package.json version: $version, tag: $TAG"
+          if [ "$version" != "$tag_version" ]; then
+            echo "package.json version ($version) does not match tag ($tag_version)" >&2
+            exit 1
+          fi
+        env:
+          TAG: ${{ inputs.tag }}
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: "npm"
+      - run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
+      - run: npm ci
+
+      - name: npm-publish-canary
+        if: ${{ inputs.channel == 'canary' }}
+        run: npm publish --tag=next ${{ inputs.dry_run && '--dry-run' || '' }}
+
+      - name: npm-publish-stable
+        if: ${{ inputs.channel == 'stable' }}
+        run: npm publish ${{ inputs.dry_run && '--dry-run' || '' }}
diff --git a/.github/workflows/released.yml b/.github/workflows/released.yml
new file mode 100644
index 0000000..bae61a2
--- /dev/null
+++ b/.github/workflows/released.yml
@@ -0,0 +1,13 @@
+name: released
+on:
+  release:
+    types: [released]
+
+jobs:
+  release-stable:
+    uses: ./.github/workflows/release-channel.yml
+    with:
+      channel: stable
+      tag: ${{ github.event.release.tag_name }}
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/semantic-pr.yml b/.github/workflows/semantic-pr.yml
new file mode 100644
index 0000000..af8142e
--- /dev/null
+++ b/.github/workflows/semantic-pr.yml
@@ -0,0 +1,21 @@
+name: "Lint PR"
+
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - reopened
+
+permissions:
+  pull-requests: read
+
+jobs:
+  main:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}