diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..1f72824
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,206 @@
+name: "publish"
+on:
+  push:
+    branches:
+      - release
+
+jobs:
+  create-release:
+    permissions:
+      contents: write
+    runs-on: ubuntu-22.04
+    outputs:
+      release_id: ${{ steps.create-release.outputs.result }}
+      package_version: ${{ env.PACKAGE_VERSION }}
+      latest_version: ${{ steps.latest-version.outputs.result }}
+      changelog: ${{ steps.github_release_changelog.outputs.changelog }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: setup node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: get version
+        run: echo "PACKAGE_VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_ENV
+
+      - name: check latest version
+        uses: actions/github-script@v7
+        id: latest-version
+        with:
+          script: |
+            const { data } = await github.request(
+              'GET /repos/{owner}/{repo}/releases/latest', 
+              {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                headers: {
+                  'X-GitHub-Api-Version': '2022-11-28'
+                }
+              }
+            )
+
+            const latesVersion = data.tag_name.slice(1)
+
+            if (latesVersion === process.env.PACKAGE_VERSION) throw new Error("当前要发布的版本号与 latest 版本号相同")
+
+            return latesVersion
+
+      - name: build changelog
+        id: github_release_changelog
+        uses: mikepenz/release-changelog-builder-action@v3
+        with:
+          configuration: ".github/changelog-configuration.json"
+          toTag: "refs/heads/main"
+          failOnError: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: create release
+        id: create-release
+        uses: actions/github-script@v7
+        env:
+          changelog: ${{ steps.github_release_changelog.outputs.changelog }}
+        with:
+          script: |
+            const { data } = await github.rest.repos.createRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              tag_name: `v${process.env.PACKAGE_VERSION}`,
+              name: `v${process.env.PACKAGE_VERSION}`,
+              body: process.env.changelog,
+              draft: true,
+            })
+            return data.id
+
+  build-tauri:
+    needs: create-release
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: "macos-latest"
+            args: "--target aarch64-apple-darwin"
+          - platform: "macos-latest"
+            args: "--target x86_64-apple-darwin"
+          - platform: "ubuntu-22.04"
+            args: ""
+          - platform: "windows-latest"
+            args: ""
+
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: setup node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - uses: oven-sh/setup-bun@v1
+
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      - name: install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libappindicator3-dev librsvg2-dev patchelf libsoup-3.0-dev libjavascriptcoregtk-4.1-dev libwebkit2gtk-4.1-dev
+
+      - name: install frontend dependencies
+        run: bun i
+
+      - uses: tauri-apps/tauri-action@v0
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          releaseId: ${{ needs.create-release.outputs.release_id }}
+          args: ${{ matrix.args }}
+
+  publish-release:
+    permissions:
+      contents: write
+    runs-on: ubuntu-22.04
+    needs: [create-release, build-tauri]
+
+    steps:
+      - name: publish release
+        id: publish-release
+        uses: actions/github-script@v7
+        env:
+          release_id: ${{ needs.create-release.outputs.release_id }}
+          PACKAGE_VERSION: ${{ needs.create-release.outputs.package_version }}
+        with:
+          script: |
+            github.rest.repos.updateRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: process.env.release_id,
+              draft: false,
+            })
+
+  upload_mirror_json:
+    permissions:
+      contents: write
+    runs-on: ubuntu-22.04
+    needs: [create-release, publish-release]
+    env:
+      release_id: ${{ needs.create-release.outputs.release_id }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: get latest.json
+        id: get-latest
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const assets = await github.rest.repos.listReleaseAssets({
+              owner: owner,
+              repo: repo,
+              release_id: process.env.release_id,
+              per_page: 50,
+            });
+            const asset = assets.data.find((e) => e.name === 'latest.json');
+
+            if (!asset) throw new Error("latest.json was not found in release assets");
+
+            const data = await github.request(
+              "GET /repos/{owner}/{repo}/releases/assets/{asset_id}",
+              {
+                owner: owner,
+                repo: repo,
+                asset_id: asset.id,
+                headers: {
+                  accept: "application/octet-stream",
+                },
+              },
+            );
+
+            return Buffer.from(data.data).toString()
+
+      - name: new mirror latest.json
+        env:
+          TEXT: ${{ steps.get-latest.outputs.result }}
+        run: |
+          cd .scripts
+          node mirror-latest-json.js
+
+      - uses: wlixcc/SFTP-Deploy-Action@v1.2.4
+        with:
+          username: thepoy
+          server: thepoy.cc
+          password: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          local_path: ./.scripts/mirrors/*
+          remote_path: /home/thepoy/app/lsar
+          sftpArgs: "-o ConnectTimeout=5"
diff --git a/.scripts/mirror-latest-json.js b/.scripts/mirror-latest-json.js
new file mode 100644
index 0000000..a3eef3f
--- /dev/null
+++ b/.scripts/mirror-latest-json.js
@@ -0,0 +1,60 @@
+import fs from "fs";
+import path from "path";
+
+const mirrors = [
+  { host: "mirror.ghproxy.com", prefix: true },
+  { host: "kkgithub.com" },
+  { host: "521github.com" },
+  { host: "hub.yzuu.cf" },
+];
+
+const GITHUB = "https://github.com/";
+
+const mirrorContent = (mirror, text) => {
+  if (mirror.prefix) {
+    return text.replaceAll(
+      GITHUB,
+      `https://${mirror.host}/https://github.com/`,
+    );
+  } else {
+    return text.replaceAll(GITHUB, `https://${mirror.host}/`);
+  }
+};
+
+const newMirrorJSON = (text, mirror, filepath) => {
+  const content = mirrorContent(mirror, text);
+  fs.writeFileSync(filepath, content);
+};
+
+const run = async () => {
+  let text = process.env.TEXT;
+
+  // 删除开头和结尾的引号
+  if (text[0] === '"') {
+    text = text.slice(1);
+  }
+
+  if (text[text.length - 1] === '"') {
+    text = text.slice(0, text.length - 1);
+  }
+
+  text = text
+    .replace("\\n}", "}") // 处理结尾的换行
+    .replaceAll("\\n ", "\n") // 删除 notes 外的换行
+    .replaceAll(/\s{2,}/g, "") // 删除所有空白符
+    .replaceAll('\\"', '"') // 替换转义的双引号
+    .replaceAll("\\\\n", "\\n"); // 处理 notes 中的换行
+
+  const currentDir = process.cwd();
+  const targetDir = path.join(currentDir, "mirrors");
+
+  if (!fs.existsSync(targetDir)) {
+    fs.mkdirSync(targetDir);
+  }
+
+  mirrors.forEach((m, i) =>
+    newMirrorJSON(text, m, path.join(targetDir, `latest-mirror-${i + 1}.json`)),
+  );
+};
+
+run();