diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index cbe0c429..f2412824 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -5,41 +5,52 @@ name: Continuous integration
 on:
   push:
 
+env:
+  HAS_SECRETS: ${{ secrets.HAS_SECRETS }}
+
 jobs:
   main:
     name: Continuous integration
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
     timeout-minutes: 60
-    env:
-      TX_USR: ${{ secrets.TX_USR }}
-      TX_PWD: ${{ secrets.TX_PWD }}
-      TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-      TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
     steps:
+      - uses: actions/checkout@v3
+
       - name: Install packages
         run: sudo apt-get install -y gettext python3-virtualenv
-      - uses: actions/checkout@v3
+
       - uses: actions/setup-node@v3
         with:
           node-version: 10
+
       - name: Build
         run: make build
+
       - name: Lint
         run: make check
+
       - name: Tests
         run: make test
+
       - name: Docker compose logs
         if: always()
         run: |
           docker-compose logs
           docker-compose down -v --remove-orphans
-      - name: Deploy PyPI
-        if: >
-          github.repository == 'camptocamp/c2cgeoform'
-          && success()
-          && (
-            startsWith(github.ref, 'refs/tags/')
-          )
+
+      - uses: camptocamp/initialise-gopass-summon-action@v2
+        with:
+          ci-gpg-private-key: ${{secrets.CI_GPG_PRIVATE_KEY}}
+          github-gopass-ci-token: ${{secrets.GOPASS_CI_GITHUB_TOKEN}}
+          patterns: pypi
+        if: env.HAS_SECRETS == 'HAS_SECRETS'
+
+      - name: Install c2cciutils
         run: |
-          sudo python3 -m pip install twine wheel
-          scripts/deploy-pypi
+          echo "${HOME}/.local/bin" >> ${GITHUB_PATH}
+          python3 -m pip install --user --upgrade pip
+          python3 -m pip install --user --requirement=ci/requirements.txt
+
+      - name: Publish
+        run: c2cciutils-publish
+        if: env.HAS_SECRETS == 'HAS_SECRETS'
diff --git a/.gitignore b/.gitignore
index 4c8d9647..82699cd5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,5 +9,6 @@
 *.egg-info
 
 .build/
+build/
 dist/
 docs/_build
diff --git a/ci/config.yaml b/ci/config.yaml
new file mode 100644
index 00000000..88cb9067
--- /dev/null
+++ b/ci/config.yaml
@@ -0,0 +1,8 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/camptocamp/c2cciutils/master/c2cciutils/schema.json
+
+publish:
+  docker:
+    images: []
+  pypi:
+    versions:
+      - version_tag
diff --git a/ci/requirements.txt b/ci/requirements.txt
new file mode 100644
index 00000000..de1710e5
--- /dev/null
+++ b/ci/requirements.txt
@@ -0,0 +1 @@
+c2cciutils[publish]==1.3.7
diff --git a/scripts/deploy-pypi b/scripts/deploy-pypi
index a27952c1..9f5ec0f0 100755
--- a/scripts/deploy-pypi
+++ b/scripts/deploy-pypi
@@ -15,9 +15,10 @@ else
 fi
 
 function deploy_pypi {
+    rm -rf dist/*
     make compile-catalog
     VERSION=$1 python3 setup.py egg_info sdist bdist_wheel
-    twine upload dist/*
+    twine upload -r testpypi dist/*
 }
 
 # Deploy tags