diff --git a/.github/workflows/build.yml b/.github/workflows/build-alpha.yml
similarity index 58%
rename from .github/workflows/build.yml
rename to .github/workflows/build-alpha.yml
index d1ebf48335d..aa9113a664d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build-alpha.yml
@@ -1,23 +1,23 @@
-name: Build
+name: '[CI] Build Alpha'
 
 on:
-    push:  # Only run on merges into master that modify files under pyscriptjs/
-        branches: main
+    push:
+        tags:
+        -   '**' # Currently any tag, need to slim down
         paths:
         -   pyscriptjs/**
-        -   .github/workflows/**  # Test that workflows work when changed
-
-    pull_request:  # Run on any PR that modifies files in pyscriptjs/
-        paths:
-        -   pyscriptjs/**
-        -   .github/workflows/**
+        -   .github/workflows/build-alpha.yml # Test that workflow works when changed
 
 jobs:
     build:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write
         defaults:
             run:
                 working-directory: ./pyscriptjs
+
         steps:
         -   name: Checkout
             uses: actions/checkout@v3
@@ -30,7 +30,7 @@ jobs:
             env:
                 cache-name: cache-node-modules
             with:
-        # npm cache files are stored in `~/.npm` on Linux/macOS
+                # npm cache files are stored in `~/.npm` on Linux/macOS
                 path: ~/.npm
                 key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
                 restore-keys: |
@@ -43,3 +43,11 @@ jobs:
         -   name: Build pyscript
             run: |
                 npm run build
+        # Deploy to S3
+        -   name: Configure AWS credentials
+            uses: aws-actions/configure-aws-credentials@v1.6.1
+            with:
+                aws-region: ${{secrets.AWS_REGION}}
+                role-to-assume: ${{ secrets.AWS_OIDC_RUNNER_ROLE }}
+        -   name: Sync to S3
+            run: aws s3 sync . s3://pyscript-static/alpha/ # What artifacts exactly need to be copied?
diff --git a/.github/workflows/lint.yml b/.github/workflows/build-latest.yml
similarity index 52%
rename from .github/workflows/lint.yml
rename to .github/workflows/build-latest.yml
index 5c10d244286..fb19705d44c 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/build-latest.yml
@@ -1,18 +1,28 @@
-name: Lint
+name: '[CI] Build Latest'
 
 on:
-    push: # Only run on merges into master that modify files under pyscriptjs/
+    push: # Only run on merges into main that modify files under pyscriptjs/
         branches:
         -   main
+        paths:
+        -   pyscriptjs/**
+        -   .github/workflows/build-latest.yml # Test that workflow works when changed
 
     pull_request: # Run on any PR that modifies files in pyscriptjs/
+        paths:
+        -   pyscriptjs/**
+        -   .github/workflows/**
 
 jobs:
     build:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write
         defaults:
             run:
                 working-directory: ./pyscriptjs
+
         steps:
         -   name: Checkout
             uses: actions/checkout@v3
@@ -25,7 +35,7 @@ jobs:
             env:
                 cache-name: cache-node-modules
             with:
-        # npm cache files are stored in `~/.npm` on Linux/macOS
+              # npm cache files are stored in `~/.npm` on Linux/macOS
                 path: ~/.npm
                 key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
                 restore-keys: |
@@ -35,6 +45,14 @@ jobs:
         -   name: Install dependencies
             run: |
                 npm install
-        -   name: Run linter
+        -   name: Build pyscript
             run: |
-                npm run lint
+                npm run build
+        # Deploy to S3
+        -   name: Configure AWS credentials
+            uses: aws-actions/configure-aws-credentials@v1.6.1
+            with:
+                aws-region: ${{secrets.AWS_REGION}}
+                role-to-assume: ${{ secrets.AWS_OIDC_RUNNER_ROLE }}
+        -   name: Sync to S3
+            run: aws s3 sync . s3://pyscript-static/unstable/ # What artifacts exactly need to be copied?
diff --git a/.github/workflows/sync-examples.yml b/.github/workflows/sync-examples.yml
new file mode 100644
index 00000000000..980f0b606e1
--- /dev/null
+++ b/.github/workflows/sync-examples.yml
@@ -0,0 +1,29 @@
+name: '[CI] Sync Examples'
+
+on:
+    push: # Only run on merges into main that modify files under pyscriptjs/examples/
+        branches:
+        -   main
+        paths:
+        -   pyscriptjs/examples/**
+        -   .github/workflows/sync-examples.yml # Test that workflow works when changed
+
+jobs:
+    build:
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write
+        defaults:
+            run:
+                working-directory: ./pyscriptjs/examples
+
+        steps:
+        # Deploy to S3
+        -   name: Configure AWS credentials
+            uses: aws-actions/configure-aws-credentials@v1.6.1
+            with:
+                aws-region: ${{secrets.AWS_REGION}}
+                role-to-assume: ${{ secrets.AWS_OIDC_RUNNER_ROLE }}
+        -   name: Sync to S3
+            run: aws s3 sync . s3://pyscript-static/examples/