diff --git a/.github/actions/commitlint/action.yml b/.github/actions/commitlint/action.yml
new file mode 100644
index 00000000..39f020a5
--- /dev/null
+++ b/.github/actions/commitlint/action.yml
@@ -0,0 +1,19 @@
+name: Commit Lint
+description: Validate current commit (last commit) or PR commits with commitlint
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-node
+
+    - name: Validate current commit (last commit) with commitlint
+      shell: bash
+      if: github.event_name == 'push'
+      run: yarn commitlint --last --verbose
+
+    - name: Validate PR commits with commitlint
+      shell: bash
+      if: github.event_name == 'pull_request'
+      run:
+        yarn commitlint --from ${{ github.event.pull_request.base.sha }} --to
+        ${{ github.event.pull_request.head.sha }} --verbose
diff --git a/.github/actions/lint/action.yml b/.github/actions/lint/action.yml
new file mode 100644
index 00000000..e6c424a8
--- /dev/null
+++ b/.github/actions/lint/action.yml
@@ -0,0 +1,11 @@
+name: Run Linters
+description: Run linter
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-node
+
+    - name: Run Linters
+      shell: bash
+      run: yarn lint:check
diff --git a/.github/actions/tests/action.yml b/.github/actions/tests/action.yml
new file mode 100644
index 00000000..0e21b5ee
--- /dev/null
+++ b/.github/actions/tests/action.yml
@@ -0,0 +1,11 @@
+name: Run Tests
+description: Run tests
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-node
+
+    - name: Run Tests
+      shell: bash
+      run: yarn test --ci
diff --git a/.github/actions/typecheck/action.yml b/.github/actions/typecheck/action.yml
new file mode 100644
index 00000000..be5114d9
--- /dev/null
+++ b/.github/actions/typecheck/action.yml
@@ -0,0 +1,11 @@
+name: Run Typecheck
+description: Run typecheck
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-node
+
+    - name: Run Typecheck
+      shell: bash
+      run: yarn tsc --noEmit
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
new file mode 100644
index 00000000..7a9f8bf5
--- /dev/null
+++ b/.github/workflows/commitlint.yml
@@ -0,0 +1,23 @@
+name: Commit Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  commitlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-node
+      - uses: ./.github/actions/commitlint
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 00000000..457c009e
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,20 @@
+name: Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/lint
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index ef280934..167abc9d 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -17,6 +17,11 @@ on:
           - major
           - minor
           - patch
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
   install:
@@ -30,24 +35,32 @@ jobs:
     needs: install
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-node
-
-      - name: Test
-        run: yarn test
+      - uses: ./.github/actions/tests
 
   lint:
     runs-on: ubuntu-latest
     needs: install
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/setup-node
+      - uses: ./.github/actions/lint
 
-      - name: Lint
-        run: yarn lint:check
+  typecheck:
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/typecheck
+
+  commitlint:
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/commitlint
 
   release:
     runs-on: ubuntu-latest
-    needs: [test, lint]
+    needs: [test, lint, typecheck, commitlint]
     permissions:
       contents: write
       id-token: write # REQUIRED FOR OIDC
@@ -57,6 +70,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          ssh-key: ${{ secrets.SELF_DEPLOY_KEY }}
       - uses: ./.github/actions/setup-node
 
       - name: Configure Git
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 00000000..76b072fe
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,21 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/tests
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
new file mode 100644
index 00000000..e4f8a1ce
--- /dev/null
+++ b/.github/workflows/typecheck.yml
@@ -0,0 +1,20 @@
+name: Typecheck
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/typecheck