diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..119800a
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,100 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  # ──────────────────────────────────────────────
+  # Job 1: Build & Push Docker Image (GHCR)
+  # ──────────────────────────────────────────────
+  docker:
+    name: Docker Build & Push
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            # Only tag as latest for stable releases (no pre-release suffix like -rc, -alpha, -beta)
+            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
+            # v2.0.6 -> 2.0.6
+            type=semver,pattern={{version}}
+            # v2.0.6 -> 2.0
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Summary
+        run: |
+          echo "## 🐳 Docker Image Published" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "**Tags:**" >> "$GITHUB_STEP_SUMMARY"
+          echo '${{ steps.meta.outputs.tags }}' | tr ',' '\n' | sed 's/^/- `/' | sed 's/$/`/' >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "**Platform:** \`linux/amd64\`" >> "$GITHUB_STEP_SUMMARY"
+
+  # ──────────────────────────────────────────────
+  # Job 2: Create GitHub Release with source code
+  # ──────────────────────────────────────────────
+  release:
+    name: GitHub Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Get version from tag
+        id: version
+        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Check for release notes
+        id: notes
+        run: |
+          NOTES_FILE="RELEASE_NOTES_${{ steps.version.outputs.VERSION }}.md"
+          if [[ -f "$NOTES_FILE" ]]; then
+            echo "file=$NOTES_FILE" >> "$GITHUB_OUTPUT"
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: v${{ steps.version.outputs.VERSION }}
+          body_path: ${{ steps.notes.outputs.found == 'true' && steps.notes.outputs.file || '' }}
+          generate_release_notes: ${{ steps.notes.outputs.found != 'true' }}
+          draft: false
+          prerelease: ${{ contains(github.ref_name, '-') }}
diff --git a/docker-compose.yml b/docker-compose.yml
index 8c5638b..4a50574 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,6 @@
 services:
   windsurf-api:
-    build:
-      context: .
-      dockerfile: Dockerfile
+    image: ghcr.io/dwgx/windsurf-api:latest
     # Remove container_name to allow Compose to scale replicas
     restart: unless-stopped
     init: true
diff --git a/nginx.conf b/nginx.conf
index 915f946..cfd3589 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -27,7 +27,7 @@ http {
         # Nginx free version requires manual IP listings for sticky sessions, 
         # or we rely on ip_hash for generic load balancing if behind a single reverse proxy.
         zone windsurf_backend_zone 64k;
-	server windsurf-api:3003 resolve;
+        server windsurf-api:3003 resolve;
     }
 
     server {