diff --git a/.forgejo/workflows/publish.yml b/.forgejo/workflows/publish.yml
new file mode 100644
index 0000000..89d2cc7
--- /dev/null
+++ b/.forgejo/workflows/publish.yml
@@ -0,0 +1,95 @@
+name: Build and Publish
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+env:
+  NODE_VERSION: '20'
+  PNPM_VERSION: '9'
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'pnpm'
+
+      - name: Configure npm for Forgejo registry
+        run: |
+          echo "@lilith:registry=https://forge.nasty.sh/api/packages/lilith/npm/" > .npmrc
+          echo "//forge.nasty.sh/api/packages/lilith/npm/:_authToken=\${NPM_TOKEN}" >> .npmrc
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build and Publish based on _ config
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          pkg_name=$(node -p "require('./package.json').name")
+          pkg_version=$(node -p "require('./package.json').version")
+
+          # Read _ config fields
+          should_build=$(node -p "require('./package.json')._?.build === true")
+          should_publish=$(node -p "require('./package.json')._?.publish === true")
+          registry=$(node -p "require('./package.json')._?.registry || 'none'")
+
+          echo "=== $pkg_name@$pkg_version ==="
+          echo "  build: $should_build, publish: $should_publish, registry: $registry"
+
+          # Only process if configured for forgejo registry
+          if [ "$registry" != "forgejo" ]; then
+            echo "Skipping: registry is not forgejo"
+            exit 0
+          fi
+
+          # Build if configured
+          if [ "$should_build" = "true" ]; then
+            echo "Building..."
+            pnpm run build
+          fi
+
+          # Publish if configured
+          if [ "$should_publish" = "true" ]; then
+            if npm view "$pkg_name@$pkg_version" version 2>/dev/null; then
+              echo "Already published, skipping"
+            else
+              echo "Publishing..."
+
+              # Transform workspace:* and file: dependencies
+              node -e "
+                const fs = require('fs');
+                const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+                const transform = (deps) => {
+                  if (!deps) return deps;
+                  for (const [name, version] of Object.entries(deps)) {
+                    if (version.startsWith('workspace:') || version.startsWith('file:')) {
+                      deps[name] = '*';
+                    }
+                  }
+                  return deps;
+                };
+                pkg.dependencies = transform(pkg.dependencies);
+                pkg.devDependencies = transform(pkg.devDependencies);
+                pkg.peerDependencies = transform(pkg.peerDependencies);
+                fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2));
+              "
+
+              npm publish --access public --no-git-checks
+            fi
+          fi
+
+          echo "=== Complete ==="