diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index f2cc4f6..0000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,39 +0,0 @@
----
-version: 2
-jobs:
-  build:
-    working_directory: /go/src/github.com/balena-io/sshproxy
-    docker:
-      - image: golang:1.18.0
-    steps:
-      - checkout
-      - run:
-          name: Install Dependencies
-          command: make dep
-      - run:
-          name: Lint Code
-          command: make lint
-      - run:
-          name: Run Tests
-          command: make test
-      - run:
-          name: Build Releases
-          command: make -j release
-      - store_artifacts:
-          name: Store Builds
-          path: build/
-      - deploy:
-          name: Upload Releases
-          command: if git describe --exact-match --tags 2>/dev/null; then make upload; fi
-workflows:
-  version: 2
-  main:
-    jobs:
-      - build:
-          filters:
-            branches:
-              ignore:
-                - /.+-build-[0-9a-f]+/
-            tags:
-              only:
-                - /^v\d+\.\d+\.\d+$/
diff --git a/.github/actions/publish/action.yml b/.github/actions/publish/action.yml
new file mode 100644
index 0000000..fa0dead
--- /dev/null
+++ b/.github/actions/publish/action.yml
@@ -0,0 +1,39 @@
+---
+name: build and draft GitHub release
+# https://github.com/product-os/flowzone/tree/master/.github/actions
+inputs:
+  json:
+    description: "JSON stringified object containing all the inputs from the calling workflow"
+    required: true
+  secrets:
+    description: "JSON stringified object containing all the secrets from the calling workflow"
+    required: true
+  variables:
+    description: "JSON stringified object containing all the variables from the calling workflow"
+    required: true
+
+runs:
+  # https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+  using: "composite"
+  steps:
+    - shell: bash
+      run: |
+        docker compose -f docker-compose.test.yml run sut 'make -j $(nproc) dep release'
+
+        # expecting five (5) of each
+        binaries="$(find build -type f -name '*.tar.gz' | wc -l)"
+        checksums="$(find build -type f -name '*.sha256' | wc -l)"
+
+        if [[ $binaries -lt $checksums ]] || [[ $binaries -lt 5 ]]; then
+            find build -type f
+            false
+        fi
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v3
+      with:
+        name: gh-release-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}
+        path: |
+          build/*.sha256
+          build/*.tar.gz
+        retention-days: 1
diff --git a/.github/workflows/flowzone.yml b/.github/workflows/flowzone.yml
new file mode 100644
index 0000000..79f1bd5
--- /dev/null
+++ b/.github/workflows/flowzone.yml
@@ -0,0 +1,28 @@
+name: Flowzone
+
+on:
+  pull_request:
+    types: [opened, synchronize, closed]
+    branches: [main, master]
+  pull_request_target:
+    types: [opened, synchronize, closed]
+    branches: [main, master]
+
+jobs:
+  flowzone:
+    name: Flowzone
+    uses: product-os/flowzone/.github/workflows/flowzone.yml@master
+    # prevent duplicate workflow executions for pull_request and pull_request_target
+    if: |
+      (
+        github.event.pull_request.head.repo.full_name == github.repository &&
+        github.event_name == 'pull_request'
+      ) || (
+        github.event.pull_request.head.repo.full_name != github.repository &&
+        github.event_name == 'pull_request_target'
+      )
+    secrets: inherit
+    with:
+      repo_config: true
+      repo_description: "sshproxy is a simple ssh server library exposing an even simpler API"
+      docker_images: ""
diff --git a/.gitignore b/.gitignore
index 273fe10..d3612ba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,6 @@ vendor/
 bin/*
 build/*
 release/*
+
+## Other
+.DS_Store
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..456320a
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1 @@
+FROM golang:1.18.0
diff --git a/Makefile b/Makefile
index 19cda73..e8932fd 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,8 @@ USERNAME ?= balena-io
 PROJECT ?= sshproxy
 EXECUTABLE ?= sshproxy
 VERSION ?= $(shell git describe --abbrev=0 --tags --exact-match 2>/dev/null || git describe)
-BUILD_PLATFORMS ?= darwin/amd64 linux/386 linux/arm linux/arm64 linux/amd64
+# https://github.com/golang/go/blob/master/src/go/build/syslist.go
+BUILD_PLATFORMS ?= darwin/amd64 darwin/arm64 linux/arm linux/arm64 linux/amd64
 SHASUM ?= sha256sum
 
 all: bin/$(EXECUTABLE)
@@ -32,21 +33,6 @@ test: test-dep
 release: $(addsuffix .tar.gz,$(addprefix build/$(EXECUTABLE)-$(VERSION)_,$(subst /,_,$(BUILD_PLATFORMS))))
 release: $(addsuffix .tar.gz.sha256,$(addprefix build/$(EXECUTABLE)-$(VERSION)_,$(subst /,_,$(BUILD_PLATFORMS))))
 
-upload-dep:
-	go install github.com/aktau/github-release@latest
-
-upload: lint test upload-dep
-ifndef GITHUB_TOKEN
-		$(error GITHUB_TOKEN is undefined)
-endif
-	git describe --exact-match --tags >/dev/null
-
-	git log --format='* %s' --grep='change-type:' --regexp-ignore-case $(shell git describe --tag --abbrev=0 $(VERSION)^)...$(VERSION) | \
-		github-release release -u $(USERNAME) -r $(PROJECT) -t $(VERSION) -n $(VERSION) -d - || true
-	$(foreach FILE, $(addsuffix .tar.gz,$(addprefix build/$(EXECUTABLE)-$(VERSION)_,$(subst /,_,$(BUILD_PLATFORMS)))), \
-		github-release upload -u $(USERNAME) -r $(PROJECT) -t $(VERSION) -n $(notdir $(FILE)) -f $(FILE) && \
-		github-release upload -u $(USERNAME) -r $(PROJECT) -t $(VERSION) -n $(notdir $(addsuffix .sha256,$(FILE))) -f $(addsuffix .sha256,$(FILE)) ;)
-
 clean:
 	rm -vrf bin/* build/*
 
@@ -63,4 +49,4 @@ build/$(EXECUTABLE)-$(VERSION)_%.tar.gz: build/%/$(EXECUTABLE)
 %.sha256: %
 	cd $(dir $<) && $(SHASUM) $(notdir $<) > $(addsuffix .sha256,$(notdir $<))
 
-.PHONY: dep lint-dep lint test-dep test release upload-dep upload clean
+.PHONY: dep lint-dep lint test-dep test release clean
diff --git a/docker-compose.test.yml b/docker-compose.test.yml
new file mode 100644
index 0000000..d011593
--- /dev/null
+++ b/docker-compose.test.yml
@@ -0,0 +1,17 @@
+---
+version: "2.4"
+
+services:
+  sut:
+    image: golang:1.18.0
+    volumes:
+      - .:/go/src/github.com/balena-io/sshproxy
+    working_dir: /go/src/github.com/balena-io/sshproxy
+    entrypoint:
+      - /bin/bash
+      - "-c"
+    command:
+      - |
+        set -axe
+
+        make -j $$(nproc) clean dep lint test
diff --git a/package-lock.json b/package-lock.json
deleted file mode 100644
index 48e341a..0000000
--- a/package-lock.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "lockfileVersion": 1
-}
diff --git a/repo.yml b/repo.yml
new file mode 100644
index 0000000..22d7f1d
--- /dev/null
+++ b/repo.yml
@@ -0,0 +1,2 @@
+---
+type: docker