diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ea57d6d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,23 @@
+#
+# Keeps the GitHub Actions used in `.github/workflows` up to date.
+#
+# The actions in our workflows are pinned to specific commit hashes (with the
+# version in a trailing comment) so that a moved tag can't silently change what
+# runs CI.  Dependabot updates both the hash and the comment for us, which
+# means the pins don't go stale.
+#
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    commit-message:
+      # Match the commit message conventions used in this repo
+      prefix: build
+    groups:
+      # Open a single PR for all action updates rather than one PR per action
+      github-actions:
+        patterns:
+          - '*'
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
new file mode 100644
index 0000000..0ca4c67
--- /dev/null
+++ b/.github/workflows/build.yaml
@@ -0,0 +1,71 @@
+#
+# Installs dependencies and runs the tests on Linux.
+#
+# This runs after changes are pushed to a feature branch.  It does not
+# run for pushes to the main branch because that is covered by the
+# `release` workflow.
+#
+# Note that this does not run the `build` script (which regenerates the
+# parser using the ANTLR tool); the generated parser is checked in, and
+# regenerating it requires a local Java + ANTLR installation.
+#
+
+name: Build
+
+on:
+  push:
+    branches-ignore:
+      - main
+  pull_request:
+
+jobs:
+  # The `build` job installs dependencies and runs the tests
+  build:
+    # We want to avoid redundant builds in the more common case where this workflow is running
+    # on a branch in the main antlr4-vensim repository.  For that case, we only care about "push"
+    # events.  The "pull_request" events are only useful for contributions from external forks.
+    # Currently there is no way to detect or filter out forks in the `on: pull_request:` section
+    # above, so we use the following logic to filter at the job level.  Only run the job if:
+    #   - this is a "push" event for a branch in the main repository, OR
+    #   - this is a "pull_request" event for an external fork
+    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      # The pnpm caching strategy in the following steps is based on:
+      #   https://github.com/pnpm/action-setup#use-cache-to-reduce-installation-time
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 10
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - name: Enable pnpm cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
+
+      - name: Install dependencies
+        shell: bash
+        run: |
+          pnpm install --frozen-lockfile
+
+      - name: Run tests
+        shell: bash
+        run: |
+          pnpm test
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..b530113
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,76 @@
+#
+# This runs after changes are merged to `main`.  There are two scenarios:
+#   1. The commit was from a feature branch being merged.  In this case,
+#      release-please will create/update a release PR to include the commit.
+#   2. The commit was from a release-please PR being merged.  In this case,
+#      the release will be tagged and the publish steps will be taken.
+#
+
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Run release-please
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        id: release
+        with:
+          # Note that we need to use a custom token here because events triggered
+          # by the special `GITHUB_TOKEN` will not create a new workflow run (to
+          # avoid creating recursive workflow runs).  In our case, we want this
+          # release-please action to trigger the `build` workflow when it pushes
+          # to a `release-please` branch; using a custom token here makes it work.
+          token: ${{ secrets.GH_ACCESS_TOKEN }}
+
+      - name: Check out repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      # The pnpm caching strategy in the following steps is based on:
+      #   https://github.com/pnpm/action-setup#use-cache-to-reduce-installation-time
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 10
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        run: echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - name: Enable pnpm cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
+
+      - name: Install dependencies
+        run: |
+          pnpm install --frozen-lockfile
+
+      - name: Run tests
+        run: |
+          pnpm test
+
+      # Save the npmjs auth token so that the workflow can publish the package to the registry
+      - name: Configure npm auth token
+        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        run: |
+          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_ACCESS_TOKEN }}" > ~/.npmrc
+
+      - name: Publish package
+        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        run: |
+          pnpm publish --access public --no-git-checks
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 0000000..7e23a4f
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "0.6.3"
+}
diff --git a/package.json b/package.json
index 859b45d..0c84b0a 100644
--- a/package.json
+++ b/package.json
@@ -8,6 +8,12 @@
     "test": "vitest run"
   },
   "main": "index.js",
+  "files": [
+    "index.js",
+    "grammar",
+    "parser/*.js",
+    "parser/*.tokens"
+  ],
   "author": "Climate Interactive",
   "license": "MIT",
   "repository": {
diff --git a/release-please-config.json b/release-please-config.json
new file mode 100644
index 0000000..c1c5e0d
--- /dev/null
+++ b/release-please-config.json
@@ -0,0 +1,15 @@
+{
+  "packages": {
+    ".": {}
+  },
+  "release-type": "node",
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": true,
+  "pull-request-title-pattern": "chore: release ${version}",
+  "changelog-sections": [
+    { "type": "feat", "hidden": false, "section": "Features" },
+    { "type": "fix", "hidden": false, "section": "Bug Fixes" },
+    { "type": "perf", "hidden": false, "section": "Performance Improvements" },
+    { "type": "deps", "hidden": false, "section": "Dependencies" }
+  ]
+}