diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
deleted file mode 100644
index 4d49a08..0000000
--- a/.github/workflows/check.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: Lint & build
-
-on: [push]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v4
-      with:
-        python-version: "3.8"
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install .[dev,cli]
-        python -m pip install opencv-python-headless>=4.8
-    - name: Lint
-      run: |
-        poe lint
-    - name: Typecheck
-      run: |
-        poe type
-    - name: Test
-      run: |
-        poe test
-    - name: Build package
-      run: |
-        poe build
-    - name: Save built package
-      uses: actions/upload-artifact@v3
-      with:
-        name: package
-        path: |
-          dist
-    - name: Publish to PyPi
-      if: ${{ github.ref_type	== 'tag' }}
-      uses: pypa/gh-action-pypi-publish@v1.6.4
-      with:
-        password: ${{ secrets.PYPI_API_TOKEN }}
-        print_hash: true
diff --git a/.github/workflows/test_build.yml b/.github/workflows/test_build.yml
new file mode 100644
index 0000000..c7800f8
--- /dev/null
+++ b/.github/workflows/test_build.yml
@@ -0,0 +1,74 @@
+name: Lint & build
+
+on: [push]
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        py_version: ["3.8", "3.9", "3.10", "3.11"]
+        include:
+          - os: windows-latest
+            py_version: "3.8"
+          - os: windows-latest
+            py_version: "3.11"
+          - os: macos-latest
+            py_version: "3.8"
+          - os: macos-latest
+            py_version: "3.11"
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ matrix.py_version }}
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install .[dev,cli]
+        python -m pip install opencv-python-headless>=4.8
+    - name: Lint
+      run: |
+        poe lint
+    - name: Typecheck
+      run: |
+        poe type
+    - name: Run tests
+      run: |
+        poe test
+
+  build:
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+    - name: Set up Python 3.8
+      uses: actions/setup-python@v4
+      with:
+        python-version: "3.8"
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip build poethepoet
+        # Install package to generate version info
+        python -m pip install --no-deps .
+    - name: Build package
+      run: |
+        poe build
+    - name: Save built package
+      uses: actions/upload-artifact@v3
+      with:
+        name: package
+        path: |
+          dist
+    - name: Publish to PyPi
+      if: ${{ github.ref_type	== 'tag' }}
+      uses: pypa/gh-action-pypi-publish@release/v1