diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 00000000..2cbacb82
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,54 @@
+name: Release CLI
+on:
+  pull_request:
+    branches: [main]
+    paths-ignore:  # ignore docs as they are built with Netlify.
+      - '**/*.md'
+      - 'site/**'
+      - 'netlify.toml'
+  push:
+    branches: [main]
+    paths-ignore:  # ignore docs as they are built with Netlify.
+      - '**/*.md'
+      - 'site/**'
+      - 'netlify.toml'
+
+  # TODO: add tag trigger
+
+env: # Update this prior to requiring a higher minor version in go.mod
+  GO_VERSION: "1.20"  # 1.xx == latest patch of 1.xx
+
+defaults:
+  run:  # use bash for all operating systems unless overridden
+    shell: bash
+
+concurrency:
+  # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-concurrency-to-cancel-any-in-progress-job-or-run
+  group: ${{ github.ref }}-${{ github.workflow }}-${{ github.actor }}
+  cancel-in-progress: true
+
+jobs:
+  pre_release:
+    name: Pre-release check
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - uses: actions/cache@v3
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/go/bin
+          key: pre-release-check-${{ runner.os }}-go-${{ matrix.go-version }}-${{ hashFiles('**/go.sum', 'Makefile') }}
+
+      - name: Make artifacts
+        run: | # Checks artifacts are buildable and versions can be correctly inserted with VERSION variable.
+          make dist VERSION=$GITHUB_SHA
+          tar xf dist/wazero_${GITHUB_SHA}_linux_amd64.tar.gz
+          ./wazero version | grep $GITHUB_SHA
+
+  # TODO: release creation job depending on pre_release, which is only run on tag creation event.
diff --git a/.gitignore b/.gitignore
index 89ac6f90..f824fdde 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,8 @@
 *.so
 *.dylib
 /wazero
+build
+dist
 
 # Test binary, built with `go test -c`
 *.test
diff --git a/Makefile b/Makefile
index d3af3630..93787434 100644
--- a/Makefile
+++ b/Makefile
@@ -258,3 +258,41 @@ fuzz:
 	@cd internal/integration_test/fuzz && cargo fuzz run basic -- -max_total_time=$(fuzz_timeout_seconds)
 	@cd internal/integration_test/fuzz && cargo fuzz run memory_no_diff -- -max_total_time=$(fuzz_timeout_seconds)
 	@cd internal/integration_test/fuzz && cargo fuzz run validation -- -max_total_time=$(fuzz_timeout_seconds)
+
+#### CLI release related ####
+
+VERSION ?= dev
+non_windows_platforms := darwin_amd64 darwin_arm64 linux_amd64 linux_arm64
+non_windows_archives  := $(non_windows_platforms:%=dist/wazero_$(VERSION)_%.tar.gz)
+# TODO: windows
+checksum_txt          := dist/wazero_$(VERSION)_checksums.txt
+
+# define macros for multi-platform builds. these parse the filename being built
+go-arch = $(if $(findstring amd64,$1),amd64,arm64)
+go-os   = $(if $(findstring .exe,$1),windows,$(if $(findstring linux,$1),linux,darwin))
+
+build/wazero_%/wazero:
+	$(call go-build,$@,$<)
+
+dist/wazero_$(VERSION)_%.tar.gz: build/wazero_%/wazero
+	@echo tar.gz "tarring $@"
+	@mkdir -p $(@D)
+	@tar -C $(<D) -cpzf $@ $(<F)
+	@echo tar.gz "ok"
+
+define go-build
+	@echo "building $1"
+	@# $(go:go=) removes the trailing 'go', so we can insert cross-build variables
+	@$(go:go=) CGO_ENABLED=0 GOOS=$(call go-os,$1) GOARCH=$(call go-arch,$1) go build \
+		-ldflags "-s -w -X github.com/tetratelabs/wazero/internal/version.version=$(VERSION)" \
+		-o $1 $2 ./cmd/wazero
+	@echo build "ok"
+endef
+
+# Darwin doesn't have sha256sum. See https://github.com/actions/virtual-environments/issues/90
+sha256sum := $(if $(findstring darwin,$(shell go env GOOS)),shasum -a 256,sha256sum)
+$(checksum_txt):
+	@cd $(@D); touch $(@F); $(sha256sum) * >> $(@F)
+
+# TODO: windows archive dependency
+dist: $(non_windows_archives) $(checksum_txt)