diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 00000000..b0b2a446
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,70 @@
+name: Hugo Staging Deploy
+
+on:
+  push:
+    branches:
+      - main
+      - add-hugo-deployment
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  deploy:
+    runs-on: ubuntu-22.04
+    environment: sshdeploy
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive  # Fetch Hugo themes (true OR recursive)
+          fetch-depth: 0    # Fetch all history for .GitInfo and .Lastmod
+          lfs: true         # Fetch Git LFS files
+
+      # no idea why, but checkout submodules doesn't work properly
+      #- name: git submodule update --init --recursive
+      #  run: git submodule update --init --recursive
+
+      - name: Setup Hugo
+        uses: peaceiris/actions-hugo@v3
+        with:
+          hugo-version: '0.97.0'
+          extended: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          # The action defaults to search for the dependency file (package-lock.json,
+          # npm-shrinkwrap.json or yarn.lock) in the repository root, and uses its
+          # hash as a part of the cache key.
+          # https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md#caching-packages-data
+          cache-dependency-path: '**/package-lock.json'
+
+      - name: Install dependencies (postcss), bootstrap-sass
+        run: npm install --save-dev autoprefixer && npm install postcss-cli && npm install -D postcss && npm install -D postcss-preset-env && npm install -D bootstrap-sass
+
+      - name: Build
+        run: cd kernelci.org;hugo --minify
+
+#      - name: Deploy
+#        uses: peaceiris/actions-gh-pages@v3
+#        if: github.ref == 'refs/heads/main'
+#        with:
+#          github_token: ${{ secrets.GITHUB_TOKEN }}
+#          publish_dir: ./public
+
+#      - name: Deploy over SSH
+#        uses: easingthemes/ssh-deploy@v2.1.5
+#        with:
+#          REMOTE_HOST: ${{ secrets.HOSTING_DEPLOY_HOST }}
+#          REMOTE_USER: deploy
+#          REMOTE_PORT: 22
+#          SOURCE: "kernelci.org/public/"
+#          TARGET: "/var/www/html"
+#          ARGS: "-avz --delete"
+#          SSH_PRIVATE_KEY: ${{ secrets.HOSTING_DEPLOY_KEY }}
+#          # dry_run: true
+#          # debug: true