diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c86668e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,80 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - 'master'
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
+  pull_request:
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        # All the (nominally) supported Ruby versions
+        ruby: ['2.5', '2.6', '2.7', '3.0', '3.1', '3.2', '3.3']
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: Run tests
+        run: bundle exec rspec
+
+      # PRs from forks and Dependabot don't have access to secrets,
+      # which are needed to upload the code coverage report to Code
+      # Climate. Save the report as an artefact for a later,
+      # privileged workflow to upload.
+      - name: Save coverage report artefact
+        # No sense uploading coverage for each Ruby version tested
+        if: matrix.ruby == '3.3'
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-json
+          path: coverage/coverage.json
+          retention-days: 1
+
+  publish:
+    needs: test
+    # Publish the gem only on push of a correctly formatted tag that
+    # passed the tests. As a push is done by somebody trusted, secrets
+    # are available.
+    #
+    # success() in the condition ensures the job runs only if the test
+    # job succeeded. Without it, this job could run if test failed but
+    # the condition otherwise passed.
+    if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+
+      - name: Build gem and publish to RubyGems
+        run: |
+          mkdir -p $HOME/.gem
+          touch $HOME/.gem/credentials
+          chmod 0600 $HOME/.gem/credentials
+          printf -- "---\n:rubygems_api_key: ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials
+          rm -f sinject-*.gem
+          gem build sinject.gemspec
+          gem push sinject-*.gem
+        env:
+          # CI_VERSION is read by gemspec to set the gem's version to
+          # that specified by the tag.
+          CI_VERSION: ${{ github.ref_name }}
+          GEM_HOST_API_KEY: "${{secrets.RUBYGEMS_AUTH_TOKEN}}"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
deleted file mode 100644
index dd95871..0000000
--- a/.github/workflows/publish.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: Publish Gem
-
-on:
-  release:
-    types:
-      - "created"
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Publish to RubyGems
-        run: |
-          mkdir -p $HOME/.gem
-          touch $HOME/.gem/credentials
-          chmod 0600 $HOME/.gem/credentials
-          printf -- "---\n:rubygems_api_key: ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials
-          gem build sinject.gemspec
-          gem push sinject-*.gem
-        env:
-          GEM_HOST_API_KEY: "${{secrets.RUBYGEMS_AUTH_TOKEN}}"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
deleted file mode 100644
index 2331ce0..0000000
--- a/.github/workflows/test.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: CI
-
-on: [push]
-
-jobs:
-  test:
-    strategy:
-      fail-fast: false
-      matrix:
-        # All the (nominally) supported Ruby versions
-        ruby: ['2.5', '2.6', '2.7', '3.0', '3.1', '3.2', '3.3']
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: ${{ matrix.ruby }}
-        bundler-cache: true
-
-    - name: Run tests
-      run: bundle exec rspec
-
-    - name: Upload Coverage Report to CodeClimate
-      # No sense uploading coverage for each Ruby version tested
-      if: ${{matrix.ruby == '3.3'}}
-      uses: paambaati/codeclimate-action@v5
-      env:
-        CC_TEST_REPORTER_ID: ${{secrets.CC_TEST_REPORTER_ID}}
diff --git a/lib/sinject/version.rb b/lib/sinject/version.rb
deleted file mode 100644
index 0b28d32..0000000
--- a/lib/sinject/version.rb
+++ /dev/null
@@ -1,5 +0,0 @@
-# Namespace
-module Sinject
-  # :nodoc:
-  VERSION = '1.1.1'.freeze
-end
diff --git a/sinject.gemspec b/sinject.gemspec
index f5766de..43914cc 100644
--- a/sinject.gemspec
+++ b/sinject.gemspec
@@ -1,11 +1,19 @@
 # coding: utf-8
 lib = File.expand_path('../lib', __FILE__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require 'sinject/version'
+
+ci_version = ENV.fetch('CI_VERSION', '')
+puts "CI version - #{ci_version}" unless ci_version.empty?
+
+version = if ci_version =~ /\Av[0-9]+\.[0-9]+\.[0-9]+/
+            ci_version[1..-1]
+          else
+            '0.0.0'
+          end
 
 Gem::Specification.new do |spec|
   spec.name          = 'sinject'
-  spec.version       = Sinject::VERSION
+  spec.version       = version
   spec.authors       = ['Sage One']
   spec.email         = ['vaughan.britton@sage.com']