diff --git a/.circleci/scripts/publish.sh b/.circleci/scripts/publish.sh
index 2c895c3255..dec8e8f898 100755
--- a/.circleci/scripts/publish.sh
+++ b/.circleci/scripts/publish.sh
@@ -25,4 +25,4 @@ NPM_TAG="latest"
 [ "$TAG_ON_RELEASE_BRANCH" -eq 1 ] && NPM_TAG="${RELEASE_BRANCH%.x}-stable"
 echo "Publishing with --tag=$NPM_TAG"
 
-npm run publish --tag="$NPM_TAG"
+npm run publish --tag="$NPM_TAG" --dry-run
diff --git a/.github/actions/yarn-install/action.yml b/.github/actions/yarn-install/action.yml
new file mode 100644
index 0000000000..1eddbdac9a
--- /dev/null
+++ b/.github/actions/yarn-install/action.yml
@@ -0,0 +1,19 @@
+name: Install Dependencies
+inputs:
+  use-min-supported-version:
+    required: false
+    default: false
+
+runs:
+  using: "composite"
+  steps:
+  - uses: actions/setup-node@v4
+    with:
+      # if both node-version-file and node-version are provided, node-version is used
+      node-version-file: 'package.json'
+      node-version: ${{ inputs.use-min-supported-version == 'false' && 'lts/*' || ''  }}
+      cache: yarn
+      cache-dependency-path: yarn.lock
+  - name: Install Dependencies
+    run: yarn install --frozen-lockfile --non-interactive --ignore-scripts
+    shell: bash
diff --git a/.github/scripts/install_codecov.sh b/.github/scripts/install_codecov.sh
new file mode 100755
index 0000000000..13b8e631d8
--- /dev/null
+++ b/.github/scripts/install_codecov.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# Install Codecov Uploader
+# See https://docs.codecov.com/docs/codecov-uploader#using-the-uploader-with-codecovio-cloud
+
+CODECOV_URL="https://uploader.codecov.io"
+
+curl "${CODECOV_URL}/verification.gpg" | gpg --no-default-keyring --keyring trustedkeys.gpg --import
+curl -Os "${CODECOV_URL}/latest/linux/codecov"
+curl -Os "${CODECOV_URL}/latest/linux/codecov.SHA256SUM"
+curl -Os "${CODECOV_URL}/latest/linux/codecov.SHA256SUM.sig"
+
+gpgv codecov.SHA256SUM.sig codecov.SHA256SUM
+shasum -a 256 -c codecov.SHA256SUM
+
+chmod +x codecov
diff --git a/.github/scripts/publish.sh b/.github/scripts/publish.sh
new file mode 100755
index 0000000000..2c895c3255
--- /dev/null
+++ b/.github/scripts/publish.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+# Copyright (c) Meta Platforms, Inc. and affiliates.
+#
+# This source code is licensed under the MIT license found in the
+# LICENSE file in the root directory of this source tree.
+
+# Reduce a semver tag name to a Metro's release branch naming convention, eg v0.1.2-alpha.3 -> 0.1.x
+RELEASE_BRANCH=$(echo "$CIRCLE_TAG" | awk -F. '{print substr($1, 2) "." $2 ".x"}')
+
+# Does a release branch contain this tag (hotfix workflow)
+TAG_ON_RELEASE_BRANCH=$(git branch -a --contains "$CIRCLE_TAG" | grep -cFx "  remotes/origin/$RELEASE_BRANCH" || true)
+echo "Tag is on release branch $RELEASE_BRANCH: $TAG_ON_RELEASE_BRANCH"
+
+# Does main contain this tag (regular release workflow)
+TAG_ON_MAIN=$(git branch -a --contains "$CIRCLE_TAG" | grep -cFx '  remotes/origin/main' || true)
+echo "Tag is on main branch: $TAG_ON_MAIN"
+
+if [ $TAG_ON_RELEASE_BRANCH -eq $TAG_ON_MAIN ]; then
+    echo "Could not determine whether this tag is 'latest' or a hotfix. Aborting."
+    exit 1
+fi
+
+NPM_TAG="latest"
+# Use a tag name like "0.123-stable" as the dist-tag for a hotfix. This *must not* be valid semver.
+[ "$TAG_ON_RELEASE_BRANCH" -eq 1 ] && NPM_TAG="${RELEASE_BRANCH%.x}-stable"
+echo "Publishing with --tag=$NPM_TAG"
+
+npm run publish --tag="$NPM_TAG"
diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
new file mode 100644
index 0000000000..82ade9e028
--- /dev/null
+++ b/.github/workflows/build-and-deploy.yml
@@ -0,0 +1,36 @@
+name: facebook/metro/build-and-deploy
+on:
+  push:
+    branches:
+      - main
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build-and-test:
+    uses: ./.github/workflows/build-and-test.yml
+    secrets: inherit
+
+  publish-to-npm:
+    needs: build-and-test
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/yarn-install
+      with:
+        use-min-supported-version: true
+    - name: Check Tag Format
+      id: check_tag
+      run: |
+        if [[ $GITHUB_REF =~ ^refs/tags/v\d+(\.\d+){2}(-.*)?$ ]]; then
+          echo "valid=true" >> $GITHUB_OUTPUT
+        else
+          echo "valid=false" >> $GITHUB_OUTPUT
+        fi
+    - run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+    - name: Infer dist-tag and run npm run publish
+      if: steps.check_tag.outputs.valid == 'true'
+      run: "./.github/scripts/publish.sh"
+    - run: rm ~/.npmrc
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
new file mode 100644
index 0000000000..1d3cf269d6
--- /dev/null
+++ b/.github/workflows/build-and-test.yml
@@ -0,0 +1,61 @@
+name: facebook/metro/build-and-test
+on:
+  workflow_call:
+  pull_request:
+    types: [opened, synchronize]
+
+# head_ref is per PR, so this ensures that updaing the latest PR commit
+# will cancel the previous run of the workflow and trigger a new one
+concurrency:
+  group: "build-and-test-${{ github.head_ref }}"
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  run-js-checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/yarn-install
+      - run: yarn typecheck
+      - run: yarn typecheck-ts
+      - run: yarn lint
+      - run: yarn test-smoke
+
+  test-with-coverage:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/yarn-install
+    - run: yarn test-coverage
+    - name: Download Codecov Uploader
+      run: "./.github/scripts/install_codecov.sh"
+    - name: Upload coverage results
+      run: "./codecov -t ${{ secrets.CODECOV_TOKEN }} -f ./coverage/coverage-final.json"
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        use-min-supported-version: [true, false]
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/yarn-install
+      with:
+        use-min-supported-version: ${{ matrix.use-min-supported-version }}
+    - name: Run Jest tests
+      run: yarn jest --ci --maxWorkers 4 --reporters=default --reporters=jest-junit
+
+  test-windows:
+    if: startsWith(github.head_ref, 'windows/')
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/yarn-install
+    - name: Run Jest tests
+      working-directory: ./
+      run: yarn jest --ci --maxWorkers 4 --reporters=default --reporters=jest-junit
+# todo: how many max workers are best performing?
diff --git a/package.json b/package.json
index c5f7e05cb6..112f5ce789 100644
--- a/package.json
+++ b/package.json
@@ -94,5 +94,8 @@
   "dependencies": {},
   "engines": {
     "node": ">=18"
+  },
+  "volta": {
+    "node": "18.0.0"
   }
 }