diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 202da0d..241a531 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,6 +16,12 @@ jobs:
         uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
+      - name: Check formatting
+        run: test -z "$(gofmt -l .)" || { gofmt -l .; exit 1; }
+      - name: Vet
+        run: go vet ./...
+      - name: Test
+        run: go test ./...
       - name: Install just
         uses: extractions/setup-just@v4
       - name: Install goreleaser
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 693d111..7c30d1f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,7 +3,8 @@ name: Release
 on:
   push:
     tags:
-      - '*'
+      - '[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
 
 permissions:
   contents: write
diff --git a/CLAUDE.md b/CLAUDE.md
index 3242962..da5e9ac 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -55,7 +55,7 @@ or `dpkg-deb` invocation). `justfile` wraps the `goreleaser` CLI so `just <targe
 local entry point. `mdview.1.md` (man page source) and `snap/` (built separately via `just snap`,
 outside goreleaser) round out packaging.
 
-`.github/workflows/release.yml` triggers on tag push, runs `just release`, and publishes a draft
+`.github/workflows/release.yml` triggers on a semver tag push (`1.2.3` or `v1.2.3`), runs `just release`, and publishes a draft
 GitHub release (goreleaser reads the version straight from the pushed git tag — no more
-previous-tag lookup step). `.github/workflows/build.yml` runs `just build` (a `goreleaser build
---snapshot`) on every push as a CI sanity check (no tests to run).
+previous-tag lookup step). `.github/workflows/build.yml` runs on every push: a `gofmt -l` check, `go vet ./...`,
+`go test ./...`, then `just build` (a `goreleaser build --snapshot`).