diff --git a/.github/workflows/ghpublish.yml b/.github/workflows/ghpublish.yml
new file mode 100644
index 0000000..59bdc93
--- /dev/null
+++ b/.github/workflows/ghpublish.yml
@@ -0,0 +1,18 @@
+# Verifies that `./script/ghpublish.bash` is WAI
+name: ghpublish
+on:
+  push:
+    branches:
+      - "release/**"
+      - "fullbuild"
+      - "ghpublishbuild"
+
+jobs:
+  test_ghpublish_bash:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - run: ./script/ghpublish_test.bash
diff --git a/.gitignore b/.gitignore
index aaaaf36..ab7fce3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@
 /DEBIAN_INSTALLED_PACKAGE.txt
 /debops-ci
 .DS_Store
+/ghpublish.out.txt
 /jafar
 /*.jsonl
 /miniooni
diff --git a/script/ghpublish-branch.out.txt b/script/ghpublish-branch.out.txt
new file mode 100644
index 0000000..f1cb2d7
--- /dev/null
+++ b/script/ghpublish-branch.out.txt
@@ -0,0 +1,2 @@
+gh release create -p rolling --target 7327e1ff7f0cfdc5ff0335574b85dc8ceb9465b6
+gh release upload rolling --clobber ABC
diff --git a/script/ghpublish-pr.out.txt b/script/ghpublish-pr.out.txt
new file mode 100644
index 0000000..f1cb2d7
--- /dev/null
+++ b/script/ghpublish-pr.out.txt
@@ -0,0 +1,2 @@
+gh release create -p rolling --target 7327e1ff7f0cfdc5ff0335574b85dc8ceb9465b6
+gh release upload rolling --clobber ABC
diff --git a/script/ghpublish-prerelease.out.txt b/script/ghpublish-prerelease.out.txt
new file mode 100644
index 0000000..8b83d1c
--- /dev/null
+++ b/script/ghpublish-prerelease.out.txt
@@ -0,0 +1,2 @@
+gh release create -p v0.0.0-alpha --target 7327e1ff7f0cfdc5ff0335574b85dc8ceb9465b6
+gh release upload v0.0.0-alpha --clobber ABC
diff --git a/script/ghpublish-release.out.txt b/script/ghpublish-release.out.txt
new file mode 100644
index 0000000..ec046d1
--- /dev/null
+++ b/script/ghpublish-release.out.txt
@@ -0,0 +1,2 @@
+gh release create v0.0.0 --target 7327e1ff7f0cfdc5ff0335574b85dc8ceb9465b6
+gh release upload v0.0.0 --clobber ABC
diff --git a/script/ghpublish.bash b/script/ghpublish.bash
index 794b961..eb7341a 100755
--- a/script/ghpublish.bash
+++ b/script/ghpublish.bash
@@ -16,10 +16,18 @@ else
 	__tag=rolling
 fi
 
+# 3. determine whether this is a pre-release
+prerelease="-p"
+if [[ $__tag =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+	prerelease=""
+fi
+
+gh=${gh:-gh}
+
 set -x
 
-# 3. create the release as a pre-release unless it already exists
-gh release create -p $__tag --target $GITHUB_SHA || true
+# 4. create the release unless it already exists
+$gh release create $prerelease $__tag --target $GITHUB_SHA || true
 
-# 4. publish all the assets passed as arguments to the target release
-gh release upload $__tag --clobber "$@"
+# 5. publish all the assets passed as arguments to the target release
+$gh release upload $__tag --clobber "$@"
diff --git a/script/ghpublish_test.bash b/script/ghpublish_test.bash
new file mode 100755
index 0000000..cfba525
--- /dev/null
+++ b/script/ghpublish_test.bash
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -euxo pipefail
+
+# Make sure we're not going to execute gh
+export gh="echo gh"
+
+# Use a very old SHA as target
+export GITHUB_SHA="7327e1ff7f0cfdc5ff0335574b85dc8ceb9465b6"
+
+# Test 1: make sure we're publishing to rolling as a
+# pre-release when the build targets a branch
+export GITHUB_REF="refs/heads/feature"
+./script/ghpublish.bash ABC > ghpublish.out.txt
+diff ./script/ghpublish-branch.out.txt ghpublish.out.txt
+
+# Test 2: make sure we're publishing to rolling as a
+# pre-release when the build target is a PR
+export GITHUB_REF="refs/pull/123/merge"
+./script/ghpublish.bash ABC > ghpublish.out.txt
+diff ./script/ghpublish-pr.out.txt ghpublish.out.txt
+
+# Test 3: make sure we're publishing to a pre-release when
+# we're building a tag that is not a stable release.
+export GITHUB_REF="refs/tags/v0.0.0-alpha"
+./script/ghpublish.bash ABC > ghpublish.out.txt
+diff ./script/ghpublish-prerelease.out.txt ghpublish.out.txt
+
+# Test 3: make sure we're publishing to a release when
+# we're building a tag that is a stable release.
+export GITHUB_REF="refs/tags/v0.0.0"
+./script/ghpublish.bash ABC > ghpublish.out.txt
+diff ./script/ghpublish-release.out.txt ghpublish.out.txt
diff --git a/script/maketarball.bash b/script/maketarball.bash
index 4a864b6..5ff77fc 100755
--- a/script/maketarball.bash
+++ b/script/maketarball.bash
@@ -10,7 +10,7 @@ if [[ $__ref == "" ]]; then
 	exit 1
 fi
 
-# 2. determine whether to publish to a release or to rolling
+# 2. determine whether to use a release tag name or just "rolling"
 if [[ $__ref =~ ^refs/tags/v ]]; then
 	__version=${__ref#refs/tags/v}
 else
@@ -25,4 +25,3 @@ set -x
 # 4. generate the actual tarball
 go mod vendor
 tar -czf ooni-probe-cli-${__version}.tar.gz --transform "s,^,ooni-probe-cli-${__version}/," *
-