diff --git a/.github/workflows/post-merge.yaml b/.github/workflows/post-merge.yaml
new file mode 100644
index 0000000000..9519b6d5e4
--- /dev/null
+++ b/.github/workflows/post-merge.yaml
@@ -0,0 +1,31 @@
+name: Post Merge
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  deploy-edge:
+    name: Push Edge Release
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Test
+        run: make travis-release-test
+        timeout-minutes: 60
+
+      - name: Build Release Binaries
+        run: make release-local
+
+      - name: Deploy OPA Edge
+        env:
+          DOCKER_USER: ${{ secrets.DOCKER_USER }}
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
+          S3_RELEASE_BUCKET: ${{ secrets.S3_RELEASE_BUCKET }}
+        run: make deploy-travis
diff --git a/.github/workflows/post-tag.yaml b/.github/workflows/post-tag.yaml
new file mode 100644
index 0000000000..4693486ef1
--- /dev/null
+++ b/.github/workflows/post-tag.yaml
@@ -0,0 +1,38 @@
+name: Post Tag
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  build:
+    name: Push Latest Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Set TAG_NAME in Environment
+        # Subsequent jobs will be have the computed tag name
+        run: echo ::set-env name=TAG_NAME::"${GITHUB_REF##*/}"
+
+      - name: Test
+        run: make travis-release-test
+        timeout-minutes: 60
+
+      - name: Build Release Binaries
+        run: make release
+
+      - name: Build and Deploy OPA Docker Images
+        env:
+          DOCKER_USER: ${{ secrets.DOCKER_USER }}
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
+        run: make release-travis
+
+      - name: Create or Update Release
+        env:
+          # Required for the `hub` CLI
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build/github-release.sh --asset-dir=./_release/${TAG_NAME#v}/ --tag=${TAG_NAME}
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
new file mode 100644
index 0000000000..2911c89233
--- /dev/null
+++ b/.github/workflows/pull-request.yaml
@@ -0,0 +1,79 @@
+name: PR Check
+
+on: [pull_request]
+
+jobs:
+  # All jobs essentially re-create the `travis-release-build` make target, but are split
+  # up for parallel runners for faster PR feedback and a nicer UX.
+
+  go-build:
+    name: Go Build
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Build Golang
+        run: make travis-go-build-all-platforms
+        timeout-minutes: 30
+
+  go-test:
+    name: Go Test
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Unit Test Golang
+        run: make travis-go-test-coverage
+        timeout-minutes: 30
+
+      - name: Codecov Upload
+        uses: codecov/codecov-action@v1
+        with:
+          tags: unittests
+          file: ./coverage.txt
+
+  go-perf:
+    name: Go Perf
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Benchmark Test Golang
+        run: make travis-go-perf
+        timeout-minutes: 30
+
+  go-lint:
+    name: Go Lint
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Golang Style and Lint Check
+        run: make travis-go-check
+        timeout-minutes: 30
+
+  wasm:
+    name: WASM
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Build and Test WASM
+        run: make travis-wasm
+        timeout-minutes: 15
+
+  check-generated:
+    name: Check Generated
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Check Working Copy
+        run: make travis-check-working-copy
+        timeout-minutes: 15
diff --git a/.gitignore b/.gitignore
index 1cca6e61a0..c09a315d05 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,7 +5,7 @@
 *~
 
 # build artifacts
-coverage
+coverage.txt
 opa_*
 .Dockerfile_*
 _release
@@ -16,6 +16,7 @@ policy.wasm
 .npm
 .gitbook
 .go
+release-notes.md
 
 # ci artifacts
 fuzzit
diff --git a/Dockerfile b/Dockerfile
index 1752e93964..48b405e730 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,7 +16,13 @@ ARG USER=0
 
 MAINTAINER Torin Sandall <torinsandall@gmail.com>
 COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-COPY opa_linux_amd64 /opa
+
+# Hack.. https://github.com/moby/moby/issues/37965
+# _Something_ needs to be between the two COPY steps.
 USER ${USER}
+
+ARG BIN_DIR=.
+COPY ${BIN_DIR}/opa_linux_amd64 /opa
+
 ENTRYPOINT ["/opa"]
 CMD ["run"]
diff --git a/Makefile b/Makefile
index 3d380dc8e0..5cbed59b23 100644
--- a/Makefile
+++ b/Makefile
@@ -14,12 +14,20 @@ GOARCH := $(shell go env GOARCH)
 GOOS := $(shell go env GOOS)
 
 DOCKER_INSTALLED := $(shell hash docker 2>/dev/null && echo 1 || echo 0)
+
+ifeq ($(shell tty > /dev/null && echo 1 || echo 0), 1)
+DOCKER_FLAGS := --rm -it
+else
+DOCKER_FLAGS := --rm
+endif
+
 DOCKER := docker
 
 BIN := opa_$(GOOS)_$(GOARCH)
 
-REPOSITORY := openpolicyagent
-IMAGE := $(REPOSITORY)/opa
+DOCKER_IMAGE ?= openpolicyagent/opa
+
+S3_RELEASE_BUCKET ?= opa-releases
 
 BUILD_COMMIT := $(shell ./build/get-build-commit.sh)
 BUILD_TIMESTAMP := $(shell ./build/get-build-timestamp.sh)
@@ -27,14 +35,13 @@ BUILD_HOSTNAME := $(shell ./build/get-build-hostname.sh)
 
 RELEASE_BUILD_IMAGE := golang:$(GOVERSION)
 
+RELEASE_DIR ?= _release/$(VERSION)
+
 LDFLAGS := "-X github.com/open-policy-agent/opa/version.Version=$(VERSION) \
 	-X github.com/open-policy-agent/opa/version.Vcs=$(BUILD_COMMIT) \
 	-X github.com/open-policy-agent/opa/version.Timestamp=$(BUILD_TIMESTAMP) \
 	-X github.com/open-policy-agent/opa/version.Hostname=$(BUILD_HOSTNAME)"
 
-GO15VENDOREXPERIMENT := 1
-export GO15VENDOREXPERIMENT
-
 ######################################################
 #
 # Development targets
@@ -75,6 +82,10 @@ go-build: generate
 go-test: generate
 	$(GO) test -tags=slow ./...
 
+.PHONY: test-coverage
+test-coverage:
+	$(GO) test -tags=slow -coverprofile=coverage.txt -covermode=atomic ./...
+
 .PHONY: perf
 perf: generate
 	$(GO) test -run=- -bench=. -benchmem ./...
@@ -176,19 +187,25 @@ wasm-rego-testgen-install:
 #
 ######################################################
 
-.PHONY: travis-go
-travis-go:
-	$(DOCKER) run \
-		--rm \
-		-u $(shell id -u):$(shell id -g) \
-		-v $(PWD):/src \
-		-w /src \
-		-e GOCACHE=/src/.go/cache \
-		golang:$(GOVERSION) \
-		make build-linux build-windows build-darwin go-test perf travis-check
+TRAVIS_GOLANG_DOCKER_MAKE := $(DOCKER) run \
+	$(DOCKER_FLAGS) \
+	-u $(shell id -u):$(shell id -g) \
+	-v $(PWD):/src \
+	-w /src \
+	-e GOCACHE=/src/.go/cache \
+	golang:$(GOVERSION) \
+	make
 
-.PHONY: travis-check
-travis-check: check
+.PHONY: travis-go-%
+travis-go-%:
+	$(TRAVIS_GOLANG_DOCKER_MAKE) $*
+
+.PHONY: travis-release-test
+travis-release-test:
+	$(TRAVIS_GOLANG_DOCKER_MAKE)
+
+.PHONY: travis-check-working-copy
+travis-check-working-copy: generate
 	./build/check-working-copy.sh
 
 # The travis-wasm target exists because we do not want to run the generate
@@ -198,67 +215,87 @@ travis-check: check
 travis-wasm: wasm-lib-test
 	GOVERSION=$(GOVERSION) ./build/run-wasm-rego-tests.sh
 
-.PHONY: travis
-travis: travis-go travis-wasm
-
 .PHONY: build-linux
-build-linux:
+build-linux: ensure-release-dir
 	@$(MAKE) build GOOS=linux
+	mv opa_linux_$(GOARCH) $(RELEASE_DIR)/
 
 .PHONY: build-darwin
-build-darwin:
+build-darwin: ensure-release-dir
 	@$(MAKE) build GOOS=darwin
+	mv opa_darwin_$(GOARCH) $(RELEASE_DIR)/
 
 .PHONY: build-windows
-build-windows:
+build-windows: ensure-release-dir
 	@$(MAKE) build GOOS=windows
-	mv opa_windows_$(GOARCH) opa_windows_$(GOARCH).exe
+	mv opa_windows_$(GOARCH) $(RELEASE_DIR)/opa_windows_$(GOARCH).exe
+
+.PHONY: ensure-release-dir
+ensure-release-dir:
+	mkdir -p $(RELEASE_DIR)
+
+.PHONY: build-all-platforms
+build-all-platforms: build-linux build-darwin build-windows
 
 .PHONY: image-quick
 image-quick:
-	$(DOCKER) build -t $(IMAGE):$(VERSION) --build-arg BASE=scratch .
-	$(DOCKER) build -t $(IMAGE):$(VERSION)-debug --build-arg BASE=gcr.io/distroless/base:debug .
-	$(DOCKER) build -t $(IMAGE):$(VERSION)-rootless --build-arg USER=1000 --build-arg BASE=scratch .
+	$(DOCKER) build \
+		-t $(DOCKER_IMAGE):$(VERSION) \
+		--build-arg BASE=scratch \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		.
+	$(DOCKER) build \
+		-t $(DOCKER_IMAGE):$(VERSION)-debug \
+		--build-arg BASE=gcr.io/distroless/base:debug \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		.
+	$(DOCKER) build \
+		-t $(DOCKER_IMAGE):$(VERSION)-rootless \
+		--build-arg USER=1000 \
+		--build-arg BASE=scratch \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		.
 
 .PHONY: push
 push:
-	$(DOCKER) push $(IMAGE):$(VERSION)
-	$(DOCKER) push $(IMAGE):$(VERSION)-debug
-	$(DOCKER) push $(IMAGE):$(VERSION)-rootless
+	$(DOCKER) push $(DOCKER_IMAGE):$(VERSION)
+	$(DOCKER) push $(DOCKER_IMAGE):$(VERSION)-debug
+	$(DOCKER) push $(DOCKER_IMAGE):$(VERSION)-rootless
 
 .PHONY: tag-latest
 tag-latest:
-	$(DOCKER) tag $(IMAGE):$(VERSION) $(IMAGE):latest
-	$(DOCKER) tag $(IMAGE):$(VERSION)-debug $(IMAGE):latest-debug
-	$(DOCKER) tag $(IMAGE):$(VERSION)-rootless $(IMAGE):latest-rootless
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION) $(DOCKER_IMAGE):latest
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-debug $(DOCKER_IMAGE):latest-debug
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-rootless $(DOCKER_IMAGE):latest-rootless
 
 .PHONY: push-latest
 push-latest:
-	$(DOCKER) push $(IMAGE):latest
-	$(DOCKER) push $(IMAGE):latest-debug
-	$(DOCKER) push $(IMAGE):latest-rootless
+	$(DOCKER) push $(DOCKER_IMAGE):latest
+	$(DOCKER) push $(DOCKER_IMAGE):latest-debug
+	$(DOCKER) push $(DOCKER_IMAGE):latest-rootless
 
 .PHONY: push-binary-edge
 push-binary-edge:
-	aws s3 cp opa_darwin_$(GOARCH) s3://opa-releases/edge/opa_darwin_$(GOARCH)
-	aws s3 cp opa_windows_$(GOARCH).exe s3://opa-releases/edge/opa_windows_$(GOARCH).exe
-	aws s3 cp opa_linux_$(GOARCH) s3://opa-releases/edge/opa_linux_$(GOARCH)
+	aws s3 cp $(RELEASE_DIR)/opa_darwin_$(GOARCH) s3://$(S3_RELEASE_BUCKET)/edge/opa_darwin_$(GOARCH)
+	aws s3 cp $(RELEASE_DIR)/opa_windows_$(GOARCH).exe s3://$(S3_RELEASE_BUCKET)/edge/opa_windows_$(GOARCH).exe
+	aws s3 cp $(RELEASE_DIR)/opa_linux_$(GOARCH) s3://$(S3_RELEASE_BUCKET)/edge/opa_linux_$(GOARCH)
 
 .PHONY: tag-edge
 tag-edge:
-	$(DOCKER) tag $(IMAGE):$(VERSION) $(IMAGE):edge
-	$(DOCKER) tag $(IMAGE):$(VERSION)-debug $(IMAGE):edge-debug
-	$(DOCKER) tag $(IMAGE):$(VERSION)-rootless $(IMAGE):edge-rootless
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION) $(DOCKER_IMAGE):edge
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-debug $(DOCKER_IMAGE):edge-debug
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-rootless $(DOCKER_IMAGE):edge-rootless
 
 .PHONY: push-edge
 push-edge:
-	$(DOCKER) push $(IMAGE):edge
-	$(DOCKER) push $(IMAGE):edge-debug
-	$(DOCKER) push $(IMAGE):edge-rootless
+	$(DOCKER) push $(DOCKER_IMAGE):edge
+	$(DOCKER) push $(DOCKER_IMAGE):edge-debug
+	$(DOCKER) push $(DOCKER_IMAGE):edge-rootless
 
 .PHONY: docker-login
 docker-login:
-	@$(DOCKER) login -u ${DOCKER_USER} -p ${DOCKER_PASSWORD}
+	@echo "Docker Login..."
+	@echo ${DOCKER_PASSWORD} | $(DOCKER) login -u ${DOCKER_USER} --password-stdin
 
 .PHONY: push-image
 push-image: docker-login image-quick push
@@ -289,23 +326,23 @@ netlify-preview: clean docs-clean build docs-live-blocks-install-deps docs-live-
 
 .PHONY: release
 release:
-	$(DOCKER) run -it --rm \
-		-v $(PWD)/_release/$(VERSION):/_release/$(VERSION) \
+	$(DOCKER) run $(DOCKER_FLAGS) \
+		-v $(PWD)/$(RELEASE_DIR):/$(RELEASE_DIR) \
 		-v $(PWD):/_src \
 		$(RELEASE_BUILD_IMAGE) \
-		/_src/build/build-release.sh --version=$(VERSION) --output-dir=/_release/$(VERSION) --source-url=/_src
+		/_src/build/build-release.sh --version=$(VERSION) --output-dir=/$(RELEASE_DIR) --source-url=/_src
 
 .PHONY: release-local
 release-local:
-	$(DOCKER) run -it --rm \
-		-v $(PWD)/_release/$(VERSION):/_release/$(VERSION) \
+	$(DOCKER) run $(DOCKER_FLAGS) \
+		-v $(PWD)/$(RELEASE_DIR):/$(RELEASE_DIR) \
 		-v $(PWD):/_src \
 		$(RELEASE_BUILD_IMAGE) \
-		/_src/build/build-release.sh --output-dir=/_release/$(VERSION) --source-url=/_src
+		/_src/build/build-release.sh --output-dir=/$(RELEASE_DIR) --source-url=/_src
 
 .PHONY: release-patch
 release-patch:
-	@$(DOCKER) run -it --rm \
+	@$(DOCKER) run $(DOCKER_FLAGS) \
 		-e LAST_VERSION=$(LAST_VERSION) \
 		-v $(PWD):/_src \
 		python:2.7 \
@@ -313,7 +350,7 @@ release-patch:
 
 .PHONY: dev-patch
 dev-patch:
-	@$(DOCKER) run -it --rm \
+	@$(DOCKER) run $(DOCKER_FLAGS) \
 		-v $(PWD):/_src \
 		python:2.7 \
 		/_src/build/gen-dev-patch.sh --version=$(VERSION) --source-url=/_src
diff --git a/README.md b/README.md
index e1c0cb6043..d8de4f973d 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # ![logo](./logo/logo-144x144.png) Open Policy Agent
 
-[![Slack Status](http://slack.openpolicyagent.org/badge.svg)](https://slack.openpolicyagent.org) [![Build Status](https://travis-ci.org/open-policy-agent/opa.svg?branch=master)](https://travis-ci.org/open-policy-agent/opa) [![Go Report Card](https://goreportcard.com/badge/open-policy-agent/opa)](https://goreportcard.com/report/open-policy-agent/opa) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1768/badge)](https://bestpractices.coreinfrastructure.org/projects/1768) [![Netlify Status](https://api.netlify.com/api/v1/badges/4a0a092a-8741-4826-a28f-826d4a576cab/deploy-status)](https://app.netlify.com/sites/openpolicyagent/deploys)
+[![Slack Status](http://slack.openpolicyagent.org/badge.svg)](https://slack.openpolicyagent.org) [![Build Status](https://github.com/open-policy-agne/opa/workflows/Post%20Merge/badge.svg)](https://github.com/open-policy-agent/opa/actions) [![Go Report Card](https://goreportcard.com/badge/open-policy-agent/opa)](https://goreportcard.com/report/open-policy-agent/opa) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1768/badge)](https://bestpractices.coreinfrastructure.org/projects/1768) [![Netlify Status](https://api.netlify.com/api/v1/badges/4a0a092a-8741-4826-a28f-826d4a576cab/deploy-status)](https://app.netlify.com/sites/openpolicyagent/deploys)
 
 The Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack.
 
diff --git a/build/build-release.sh b/build/build-release.sh
index add25069b1..86f8ca2311 100755
--- a/build/build-release.sh
+++ b/build/build-release.sh
@@ -42,11 +42,7 @@ elif [ -z "$SOURCE_URL" ]; then
 fi
 
 build_release() {
-    GOOS=darwin GOARCH=amd64 make build
-    GOOS=linux GOARCH=amd64 make build
-    GOOS=windows GOARCH=amd64 make build
-    mv opa_windows_amd64 opa_windows_amd64.exe
-    mv opa_*_* $OUTPUT_DIR
+    make build-all-platforms RELEASE_DIR="${OUTPUT_DIR}"
 }
 
 clone_repo() {
@@ -60,7 +56,6 @@ clone_repo() {
 main() {
     clone_repo
     build_release
-    make test
 }
 
 main
diff --git a/build/github-release.sh b/build/github-release.sh
new file mode 100755
index 0000000000..6c92554c72
--- /dev/null
+++ b/build/github-release.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Script to draft and edit OPA GitHub releases. Assumes execution environment is Github Action runner.
+
+set -x
+
+usage() {
+    echo "github-release.sh [--asset-dir=<path>] [--tag=<git tag>]"
+    echo "    Default --asset-dir is $PWD and --tag $TAG_NAME "
+}
+
+TAG_NAME=${TAG_NAME}
+ASSET_DIR=${PWD:-"./"}
+
+for i in "$@"; do
+    case $i in
+    --asset-dir=*)
+        ASSET_DIR="${i#*=}"
+        shift
+        ;;
+    --tag=*)
+        TAG_NAME="${i#*=}"
+        shift
+        ;;
+    *)
+        usage
+        exit 1
+        ;;
+    esac
+done
+
+# Collect a list of opa binaries (expect binaries in the form: opa_<platform>_<arch>[extension])
+ASSETS=()
+for asset in "${ASSET_DIR}"/opa_*_*; do
+    ASSETS+=("-a" "$asset")
+done
+
+# Gather the release notes from the CHANGELOG for the latest version
+RELEASE_NOTES="release-notes.md"
+
+# The hub CLI expects the first line to be the title
+echo -e "${TAG_NAME}\n" > "${RELEASE_NOTES}"
+
+# Fill in the description
+./build/latest-release-notes.sh --output="${RELEASE_NOTES}"
+
+# Update or create a release on github
+if hub release show "${TAG_NAME}" > /dev/null; then
+    # Occurs when the tag is created via GitHub UI w/ a release
+    # Use -m "" to preserve the existing text.
+    hub release edit "${ASSETS[@]}" -m "" "${TAG_NAME}"
+else
+    # Create a draft release
+    hub release create "${ASSETS[@]}" -F ${RELEASE_NOTES} --draft "${TAG_NAME}"
+fi
diff --git a/build/latest-release-notes.sh b/build/latest-release-notes.sh
new file mode 100755
index 0000000000..999021cf5c
--- /dev/null
+++ b/build/latest-release-notes.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+set -e
+
+OPA_DIR=$(dirname "${BASH_SOURCE}")/..
+CHANGELOG="${OPA_DIR}/CHANGELOG.md"
+
+usage() {
+    echo "latest-release-notes.sh --output=<path>"
+}
+
+OUTPUT=""
+
+for i in "$@"; do
+    case $i in
+    --output=*)
+        OUTPUT="${i#*=}"
+        shift
+        ;;
+    *)
+        usage
+        exit 1
+        ;;
+    esac
+done
+
+if [ -z "${OUTPUT}" ]; then
+    usage
+    exit 1
+fi
+
+# Versions start with a h2 (## <semver>), find the latest two for start and stop
+# positions in the CHANGELOG
+LATEST_VERSION=$(grep '## [0-9]' "${CHANGELOG}" | head -n 1)
+STOP_VERSION=$(grep '## [0-9]' "${CHANGELOG}" | head -n 2 | tail -n 1)
+
+STARTED=false
+
+while IFS= read -r line
+do
+    # Skip lines until the first version header is found
+    if [[ "${STARTED}" == false ]]; then
+        if [[ "${line}" == "${LATEST_VERSION}" ]]; then
+            STARTED=true
+        fi
+        continue
+    fi
+
+    # Stop reading after we see the stopping point
+    if [[ "${line}" == "${STOP_VERSION}" ]]; then
+        break
+    fi
+
+    # Append each line between the two onto the release notes
+    echo -e "${line}" >> "${OUTPUT}"
+
+done < "${CHANGELOG}"
+
+# Delete all leading blank lines at top of file
+sed -i.bak '/./,$!d' "${OUTPUT}"
+rm "${OUTPUT}.bak"
diff --git a/codecov.yaml b/codecov.yaml
new file mode 100644
index 0000000000..69cb76019a
--- /dev/null
+++ b/codecov.yaml
@@ -0,0 +1 @@
+comment: false
diff --git a/docs/devel/DEVELOPMENT.md b/docs/devel/DEVELOPMENT.md
index c4417bcc75..ba5dc54012 100644
--- a/docs/devel/DEVELOPMENT.md
+++ b/docs/devel/DEVELOPMENT.md
@@ -143,3 +143,22 @@ files in the root of this repository:
 
 * `.go-version`- which is used by the Makefile and CI tooling. Put the exact go
   version that OPA should use.
+
+# CI Configuration
+
+OPA uses Github Actions defined in the [.github/workflows](../../.github/workflows)
+directory.
+
+## Required Secrets
+
+The following secrets are assumed to be configured for the Repository. Any fork of
+OPA will need to have them configured to be able to run the full CI workflow.
+
+| Name | Description |
+|------|-------------|
+| S3_RELEASE_BUCKET | AWS S3 Bucket name to upload `edge` release binaries to. |
+| AWS_ACCESS_KEY_ID | AWS credentials required to upload to the configured `S3_RELEASE_BUCKET`. |
+| AWS_SECRET_ACCESS_KEY | AWS credentials required to upload to the configured `S3_RELEASE_BUCKET`. |
+| DOCKER_IMAGE | Full docker image name (with org) to tag and publish images to. |
+| DOCKER_USER | Docker username for uploading release images. Will be used with `docker login` |
+| DOCKER_PASSWORD | Docker password or API token for the configured `DOCKER_USER`. Will be used with `docker login` |
diff --git a/docs/devel/RELEASE.md b/docs/devel/RELEASE.md
index 3d0521c7ad..ff6f0ab88d 100644
--- a/docs/devel/RELEASE.md
+++ b/docs/devel/RELEASE.md
@@ -2,32 +2,30 @@
 
 ## Overview
 
-The release process consists of three phases: versioning, building, and
-publishing.
+The release process consists of two phases: versioning and publishing the release.
 
 Versioning involves maintaining the following files:
 
 - **CHANGELOG.md** - this file contains a list of all the important changes in each release.
 - **Makefile** - the Makefile contains a VERSION variable that defines the version of the project.
-- **docs/website/RELEASES*** - this file determines which versions of documentation are displayed
-  in the public [documentation](https://openpolicyagent.org/docs). __The first entry on the list is
-  considered to be the latest.__
 
 The steps below explain how to update these files. In addition, the repository
 should be tagged with the semantic version identifying the release.
 
-Building involves obtaining a copy of the repository, checking out the release
-tag, and building the binaries.
-
 Publishing involves creating a new *Release* on GitHub with the relevant
 CHANGELOG.md snippet and uploading the binaries from the build phase.
 
 ## Versioning
 
-1. Obtain a copy of repository.
+The steps below assume an OPA development environment has configured for the
+standard GitHub fork workflow. See [OPA Dev Instructions](DEVELOPMENT.md)
+
+1. The following steps assume a remote named `upstream` exists that references the OPA source
+   repository. As needed, add an `upstream` remote for the repository:
 
 	```
-	git clone git@github.com:open-policy-agent/opa.git
+	git remote add upstream git@github.com:open-policy-agent/opa.git
+	git fetch --tags upstream
 	```
 
 1. Execute the release-patch target to generate boilerplate patch. Give the semantic version of the release:
@@ -47,19 +45,23 @@ CHANGELOG.md snippet and uploading the binaries from the build phase.
 	> changes may not be user facing (so remove them). Also, if there have been
 	> any significant API changes, call them out in their own sections.
 
-1. Commit the changes and push to remote repository.
+1. Commit the changes and push to remote repository fork.
 
 	```
 	git commit -a -s -m "Prepare v<version> release"
 	git push origin master
 	```
 
-1. Tag repository with release version and push tags to remote repository.
+1. Create a Pull Request for the release preparation commit.
 
-	```
-	git tag v<semver>
-	git push origin --tags
-	```
+1. Once the Pull Request has merged fetch the latest changes and tag the commit to prepare for publishing:
+
+    ```
+    git fetch upstream
+    git tag v<semver> upstream/master
+    ```
+
+    > Note: Ensure that tag is pointing to the correct commit ID! It must be the merged release preparation commit.
 
 1. Execute the dev-patch target to generate boilerplate patch. Give the semantic version of the next release:
 
@@ -76,35 +78,31 @@ CHANGELOG.md snippet and uploading the binaries from the build phase.
 	git diff
 	```
 
-1. Commit the changes and push to remote repository.
+1. Commit the changes and push to remote repository fork.
 
 	```
 	git commit -a -s -m "Prepare v<next_semvar> development"
 	git push origin master
 	```
 
-## Building
-
-1. Obtain copy of remote repository.
-
-	```
-	git clone git@github.com:open-policy-agent/opa.git
-	```
-
-1. Execute the release target. The results can be found under _release/VERSION:
-
-	```
-	make release VERSION=0.12.8
-	```
+1. Create a Pull Request for the development preparation commit.
 
 ## Publishing
 
-1. Open browser and go to https://github.com/open-policy-agent/opa/releases
+1. Push the release tag to remote source repository.
 
-1. Create a new release for the version.
-	- Copy the changelog content into the message.
-	- Upload the binaries.
+	```
+	git push upstream v<semver>
+	```
 
+   > Note: Only OPA maintainers will have permissions to perform this step.
+
+1. Open browser and go to [https://github.com/open-policy-agent/opa/releases](https://github.com/open-policy-agent/opa/releases)
+
+1. Update the draft release (may take up to 20 min for the draft to become
+   available, track its process under
+   [https://github.com/open-policy-agent/opa/actions](https://github.com/open-policy-agent/opa/actions)).
+   Ensure everything looks OK and publish when ready.
 
 ## Notes
 
diff --git a/wasm/Makefile b/wasm/Makefile
index 9ecc4ad08e..6dd7419af6 100644
--- a/wasm/Makefile
+++ b/wasm/Makefile
@@ -1,5 +1,11 @@
 DOCKER := docker
 
+ifeq ($(shell tty > /dev/null && echo 1 || echo 0), 1)
+DOCKER_FLAGS := --rm -it
+else
+DOCKER_FLAGS := --rm
+endif
+
 WASM_BUILDER_REPOSITORY := openpolicyagent/opa-wasm-builder
 WASM_BUILDER_VERSION := 1.0
 WASM_BUILDER_IMAGE := $(WASM_BUILDER_REPOSITORY):$(WASM_BUILDER_VERSION)
@@ -29,16 +35,16 @@ builder: Dockerfile
 
 .PHONY: build
 build:
-	@$(DOCKER) run -it --rm -v $(CURDIR):/src $(WASM_BUILDER_IMAGE) make $(WASM_OBJ_DIR)/opa.wasm
+	@$(DOCKER) run $(DOCKER_FLAGS) -v $(CURDIR):/src $(WASM_BUILDER_IMAGE) make $(WASM_OBJ_DIR)/opa.wasm
 
 .PHONY: test
 test:
-	@$(DOCKER) run -it --rm -v $(CURDIR):/src $(WASM_BUILDER_IMAGE) make $(WASM_OBJ_DIR)/opa-test.wasm
-	@$(DOCKER) run -it --rm -e VERBOSE=$(VERBOSE) -v $(CURDIR):/src -w /src node:8 node test.js $(WASM_OBJ_DIR)/opa-test.wasm
+	@$(DOCKER) run $(DOCKER_FLAGS) -v $(CURDIR):/src $(WASM_BUILDER_IMAGE) make $(WASM_OBJ_DIR)/opa-test.wasm
+	@$(DOCKER) run $(DOCKER_FLAGS) -e VERBOSE=$(VERBOSE) -v $(CURDIR):/src -w /src node:8 node test.js $(WASM_OBJ_DIR)/opa-test.wasm
 
 .PHONY: hack
 hack:
-	@$(DOCKER) run -it --rm -v $(CURDIR):/src $(WASM_BUILDER_IMAGE)
+	@$(DOCKER) run $(DOCKER_FLAGS) -v $(CURDIR):/src $(WASM_BUILDER_IMAGE)
 
 $(shell mkdir -p $(WASM_OBJ_DIR)/src/lib)
 $(shell mkdir -p $(WASM_OBJ_DIR)/src/libmpdec)