diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ab20e8e..1ea15f7 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -3,9 +3,88 @@
 
 on:
   push:
+    branches:
+      - '**'
+    tags:
+      - '**'
+  pull_request:
+
+env:
+  IMAGE_RETENTION_DAYS: 7
+  IMAGE_NAME: ospo-code-scanner-v2
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: managed-linux
+
+    permissions:
+      contents: read
+      packages: write
+
     steps:
-      - uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # 7.0.1
+
+      - name: Determine image metadata
+        id: metadata
+        shell: bash
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+
+          sanitize() {
+            echo "$1" \
+              | tr '[:upper:]' '[:lower:]' \
+              | sed 's#[^a-z0-9._-]#-#g' \
+              | sed 's#--*#-#g' \
+              | sed 's#^-##' \
+              | sed 's#-$##' \
+              | cut -c1-80
+          }
+
+          LABELS=(
+            "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" 
+            "org.opencontainers.image.revision=${GITHUB_SHA}"
+          )
+
+          if [[ "${GITHUB_REF}" == "refs/heads/main" ]]; then
+            IMAGE_TAG="latest"
+          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            TAG_NAME="${GITHUB_REF#refs/tags/}"
+            IMAGE_TAG="$(sanitize "${TAG_NAME}")"
+          elif [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
+            PR_TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH")
+            IMAGE_TAG="pr-$(sanitize "${PR_TITLE}")-${SHORT_SHA}"
+            LABELS+="retention.days=${IMAGE_RETENTION_DAYS}"
+            LABELS+="quay.expires-after=${IMAGE_RETENTION_DAYS}d"
+          else
+            IMAGE_TAG="branch-$(sanitize "${GITHUB_REF_NAME}")-${SHORT_SHA}"
+            LABELS+="retention.days=${IMAGE_RETENTION_DAYS}"
+            LABELS+="quay.expires-after=${IMAGE_RETENTION_DAYS}d"
+          fi
+
+          echo "image_tag=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
+          echo "labels=${LABELS[@]}">> "$GITHUB_OUTPUT"
+
+          echo "Using tag: ${IMAGE_TAG}"
+          echo "Using labels: ${LABELS[@]}"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # 4.4.1
+
+      - name: Login GHCR
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # 4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push image
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # 4.7.0
+        with:
+          context: .
+          file: ./Containerfile
+          push: true
+          tags: ghcr.io/${{ github.repository }}:${{ steps.metadata.outputs.image_tag }}
+          labels: ${{ steps.metadata.outputs.labels }}
+          cache-from: type=gha