diff --git a/.github/main.workflow b/.github/main.workflow
index 0144cd7..33655f5 100644
--- a/.github/main.workflow
+++ b/.github/main.workflow
@@ -1,8 +1,3 @@
-workflow "Build and Publish" {
-  resolves = "Docker Publish"
-  on = "push"
-}
-
 action "Shell Lint" {
   uses = "actions/bin/shellcheck@master"
   args = "entrypoint.sh"
@@ -67,3 +62,55 @@ action "Test [PR]" {
   uses = "actions/bin/bats@master"
   args = "test/*.bats"
 }
+
+workflow "Build and Publish" {
+  resolves = ["Test [N]", "Docker Login [N]", "Docker Publish [N]", "Docker Lint [N]"]
+  on = "push"
+}
+
+action "Master Branch" {
+  uses = "actions/bin/filter@master"
+  args = "branch master"
+}
+
+action "Docker Lint [N]" {
+  uses = "docker://replicated/dockerfilelint"
+  needs = ["Master Branch"]
+  args = "[\"Dockerfile\"]"
+}
+
+action "Shell Lint [N]" {
+  uses = "actions/bin/shellcheck@master"
+  needs = ["Master Branch"]
+  args = "entrypoint.sh"
+}
+
+action "Test [N]" {
+  uses = "actions/bin/bats@master"
+  needs = ["Master Branch"]
+  args = "test/*.bats"
+}
+
+action "Build [N]" {
+  uses = "actions/docker/cli@master"
+  needs = ["Shell Lint [N]", "Test [N]", "Docker Lint [N]"]
+  args = "build -t yarn ."
+}
+
+action "Docker Tag [N]" {
+  uses = "actions/docker/tag@master"
+  needs = ["Build [N]"]
+  args = "yarn borales/yarn --no-latest"
+}
+
+action "Docker Login [N]" {
+  uses = "actions/docker/login@master"
+  needs = ["Build [N]"]
+  secrets = ["DOCKER_PASSWORD", "DOCKER_USERNAME"]
+}
+
+action "Docker Publish [N]" {
+  uses = "actions/docker/cli@master"
+  needs = ["Docker Tag [N]", "Docker Login [N]"]
+  args = "push borales/yarn"
+}