diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..7dd400c
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,38 @@
+name: build-twa
+on:
+  push:
+    branches: [ main ]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      KEYSTORE_PASS: ${{ secrets.KEYSTORE_PASS }}
+      KEY_PASS: ${{ secrets.KEY_PASS }}
+      KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: 11
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: 18
+    - name: Install Bubblewrap
+      run: npm install -g @bubblewrap/cli
+    - name: Decode keystore
+      run: |
+        echo "${{ secrets.JKS_BASE64 }}" | base64 --decode > sune-keystore.jks
+        chmod 600 sune-keystore.jks
+    - name: Sanity show SHA256
+      run: keytool -list -v -keystore sune-keystore.jks -alias "${{ secrets.KEY_ALIAS }}" -storepass "${{ secrets.KEYSTORE_PASS }}" | grep -i "SHA256"
+    - name: Bubblewrap build & sign
+      run: |
+        bubblewrap build --keystorePath=sune-keystore.jks --keystoreAlias="${KEY_ALIAS}" --keystorePassword="${KEYSTORE_PASS}" --keyPassword="${KEY_PASS}"
+    - name: Upload APK
+      uses: actions/upload-artifact@v4
+      with:
+        name: sune-apk
+        path: android-build-output/*.apk || app/build/outputs/apk/release/*.apk