diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index b8465d96e5..e7d8c53b90 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -17,10 +17,11 @@ jobs:
     name: Node ${{ matrix.node-version }} on ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v2
-      - name: find location of yarn cache
+      - name: find location of global yarn cache
         id: yarn-cache
         run: echo "::set-output name=dir::$(yarn cache dir)"
-      - uses: actions/cache@v1
+      - name: cache global yarn cache
+        uses: actions/cache@v1
         with:
           path: ${{ steps.yarn-cache.outputs.dir }}
           key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index fecab189e1..363299b335 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -19,10 +19,11 @@ jobs:
       - uses: actions/checkout@v2
       - name: fetch branch master
         run: git fetch origin master
-      - name: find location of yarn cache
+      - name: find location of global yarn cache
         id: yarn-cache
         run: echo "::set-output name=dir::$(yarn cache dir)"
-      - uses: actions/cache@v1
+      - name: cache global yarn cache
+        uses: actions/cache@v1
         with:
           path: ${{ steps.yarn-cache.outputs.dir }}
           key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
new file mode 100644
index 0000000000..1985215a0e
--- /dev/null
+++ b/.github/workflows/master.yml
@@ -0,0 +1,54 @@
+name: Master Build
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [12.x]
+
+    env:
+      CI: true
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: find location of global yarn cache
+        id: yarn-cache
+        run: echo "::set-output name=dir::$(yarn cache dir)"
+      - name: cache global yarn cache
+        uses: actions/cache@v1
+        with:
+          path: ${{ steps.yarn-cache.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-yarn-
+      - name: cache node_modules
+        uses: actions/cache@v1
+        with:
+          path: node_modules
+          key: ${{ runner.os }}-modules-${{ hashFiles('yarn.lock') }}
+      - name: use node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v1
+        with:
+          node-version: ${{ matrix.node-version }}
+          registry-url: https://registry.npmjs.org/ # Needed for auth
+      - run: yarn install
+      - run: yarn lint
+      - run: yarn build
+      - run: yarn test
+      # Publishes current version of packages that are not already present in the registry
+      - name: publish
+        run: npx --no-install lerna publish from-package --yes
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      # Tags the commit with the version in the core package if the tag doesn't exist
+      - uses: Klemensas/action-autotag@1.2.3
+        with:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          package_root: "packages/core"
+          tag_prefix: "v"
diff --git a/docs/README.md b/docs/README.md
index 74e71370e1..c645b33024 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -5,3 +5,4 @@ Check out [https://backstage.io]() or see the table of content below.
 - [Architecture and terminology](architecture-terminology.md)
 - [Getting started](getting-started/README.md)
 - [References](reference/README.md)
+- [Publishing](publishing.md)
diff --git a/docs/publishing.md b/docs/publishing.md
new file mode 100644
index 0000000000..15eaadd95d
--- /dev/null
+++ b/docs/publishing.md
@@ -0,0 +1,37 @@
+# Publishing
+
+## NPM
+
+NPM packages are published through CI/CD in the
+[.github/workflows/master.yml](../.github/workflows/master.yml) workflow. Every
+commit that is merged to master will be checked for new versions of all public
+packages, and any new versions will automatically be published to NPM.
+
+### Creating a new release
+
+Version bumps are made through release PRs. To create a new release, checkout out
+a new branch that you will use for the release, e.g.
+
+```sh
+$ git checkout -b new-release
+```
+
+Then, from the root of the repo, run
+
+```sh
+$ yarn release
+```
+
+This will bring up the lerna release CLI where you choose what type of version bump
+you want to make, (major/minor/patch/prerelease). The CLI will take you through choosing
+a version, previewing all changes, and then approving the release. Once the release
+is approved, a new commit is created that you can submit as a PR. Push the branch to GitHub:
+
+```sh
+$ git push origin -u new-release
+```
+
+And then create a PR. Once the PR is approved and merged into master, the master build
+will publish new versions of all bumped packages.
+
+[Back to Docs](README.md)
diff --git a/package.json b/package.json
index 8a008a5ed3..a25335f659 100644
--- a/package.json
+++ b/package.json
@@ -9,6 +9,7 @@
     "build": "lerna run build",
     "test": "cross-env CI=true lerna run test --since origin/master -- --coverage",
     "create-plugin": "backstage-cli create-plugin",
+    "release": "if [ \"$(git symbolic-ref --short HEAD)\" = master ]; then echo \"don't try to release master\"; exit 1; else lerna version --no-push; fi",
     "lint": "lerna run lint",
     "storybook": "yarn workspace storybook start"
   },
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 657315d959..1e85c44c97 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -24,6 +24,9 @@
     "test": "backstage-cli test",
     "start": "nodemon ."
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "devDependencies": {
     "@types/fs-extra": "^8.1.0",
     "@types/html-webpack-plugin": "^3.2.2",
diff --git a/packages/cli/templates/default-plugin/package.json.hbs b/packages/cli/templates/default-plugin/package.json.hbs
index 20b78a268b..d8a303184c 100644
--- a/packages/cli/templates/default-plugin/package.json.hbs
+++ b/packages/cli/templates/default-plugin/package.json.hbs
@@ -4,7 +4,7 @@
   "main": "dist/cjs/index.js",
   "types": "dist/cjs/index.d.ts",
   "license": "Apache-2.0",
-  "private": false,
+  "private": true,
   "scripts": {
     "build": "backstage-cli plugin:build",
     "lint": "backstage-cli lint",
diff --git a/packages/core/package.json b/packages/core/package.json
index d1fb12fdec..b18705316c 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -23,6 +23,9 @@
     "lint": "backstage-cli lint",
     "test": "backstage-cli test"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "dependencies": {
     "@material-ui/core": "^4.9.1",
     "@material-ui/icons": "^4.9.1",
diff --git a/plugins/home-page/package.json b/plugins/home-page/package.json
index 5380d8d25b..5869b5fde0 100644
--- a/plugins/home-page/package.json
+++ b/plugins/home-page/package.json
@@ -3,6 +3,7 @@
   "version": "0.1.0",
   "main": "dist/cjs/index.js",
   "types": "dist/cjs/index.d.ts",
+  "private": true,
   "devDependencies": {
     "@spotify-backstage/cli": "^0.1.0",
     "@spotify-backstage/core": "^0.1.0",
diff --git a/plugins/welcome/package.json b/plugins/welcome/package.json
index 1d5f6a7373..734ba4fea6 100644
--- a/plugins/welcome/package.json
+++ b/plugins/welcome/package.json
@@ -4,7 +4,7 @@
   "main": "dist/cjs/index.js",
   "types": "dist/cjs/index.d.ts",
   "license": "Apache-2.0",
-  "private": false,
+  "private": true,
   "scripts": {
     "build": "backstage-cli plugin:build",
     "lint": "backstage-cli lint",