diff --git a/.github/workflows/cargo-expand.yml b/.github/workflows/cargo-expand.yml
new file mode 100644
index 0000000..77141c5
--- /dev/null
+++ b/.github/workflows/cargo-expand.yml
@@ -0,0 +1,29 @@
+name: cargo-expand
+
+on:
+  push:
+    tags:
+      - cargo-expand
+
+jobs:
+  build:
+    name: cargo-expand
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo install cargo-expand
+      - id: which
+        run: echo "::set-output name=which::$(which cargo-expand)"
+      - run: echo "$PRIVATE_KEY" | gpg --import
+        env:
+          PRIVATE_KEY: ${{secrets.PRIVATE_KEY}}
+      - run: gpg --output cargo-expand.sig --detach-sig ${{steps.which.outputs.which}}
+      - run: gpg --output signing-key.gpg --dearmor signing-key.asc
+      - run: gpg --no-default-keyring --keyring ./signing-key.gpg --verify cargo-expand.sig ${{steps.which.outputs.which}}
+      - uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            ${{steps.which.outputs.which}}
+            cargo-expand.sig
+          fail_on_unmatched_files: true