diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index e11854a..5efa7b0 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -1,18 +1,21 @@
 name: pull request
 on:
-  pull_request: 
+  pull_request:
     types:
       - opened
       - reopened
       - synchronize
-jobs: 
+jobs:
   pr-build:
     runs-on: ubuntu-latest
-    steps: 
-      -
-        name: Checkout
+    steps:
+      - name: Checkout
         uses: actions/checkout@v4
-      -
-        name: Build to test
+        with:
+          fetch-depth: 0
+      - name: Commitsar check
+        uses: aevea/commitsar@v0.20.2
+      - name: Build to test
+        env:
+          SKIP_COMPRESS: "true"
         run: make ci
-
diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index e505d3e..7d701e4 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -13,6 +13,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - name: Login to Aliyun ACR
         uses: docker/login-action@v3
         with:
@@ -35,7 +37,9 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/')
         env: 
           CROSS: tag
-        run: make github_ci
+        run: |
+          make github_ci
+          make release-note
 
       - name: Prepare for packaging image
         run: cp dist/* package/
@@ -68,3 +72,10 @@ jobs:
           context: package
           push: true
         if: ${{ env.ALIYUN == 'true' }}
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          files: dist/*
+          body_path: dist/release-note
+          draft: true
\ No newline at end of file
diff --git a/Dockerfile.dapper b/Dockerfile.dapper
index 3a14c1d..4bc4a64 100644
--- a/Dockerfile.dapper
+++ b/Dockerfile.dapper
@@ -1,3 +1,5 @@
+FROM aevea/release-notary:0.9.2 as tools
+
 FROM registry.suse.com/bci/golang:1.22
 ARG PROXY
 ARG GOPROXY
@@ -16,10 +18,10 @@ RUN curl -sL https://github.com/upx/upx/releases/download/v${UPX_VERSION}/upx-${
 RUN if [ "${ARCH}" == "amd64" ]; then \
     curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.54.2; \
     fi
-
+COPY --from=tools /app/release-notary /usr/local/bin/
 ENV CATTLE_DASHBOARD_UI_VERSION="v2.8.0-kube-explorer-ui-rc3"
     
-ENV DAPPER_ENV REPO TAG DRONE_TAG CROSS GOPROXY
+ENV DAPPER_ENV REPO TAG DRONE_TAG CROSS GOPROXY SKIP_COMPRESS GITHUB_REPOSITORY GITHUB_TOKEN
 ENV DAPPER_SOURCE /go/src/github.com/cnrancher/kube-explorer
 ENV DAPPER_OUTPUT ./bin ./dist
 ENV DAPPER_DOCKER_SOCKET true
diff --git a/scripts/build b/scripts/build
index 4ad39cb..6d7fb8b 100755
--- a/scripts/build
+++ b/scripts/build
@@ -4,6 +4,8 @@ set -e
 source "$(dirname $0)/version"
 cd "$(dirname $0)/.."
 
+rm -rf ./bin/* ./dist/*
+
 OS_ARCH_ARG_LINUX="amd64 arm arm64"
 OS_ARCH_ARG_DARWIN="amd64 arm64"
 OS_ARCH_ARG_WINDOWS="amd64"
@@ -61,19 +63,19 @@ case "$CROSS" in
         ;;
 esac
 
-mkdir -p "$DAPPER_SOURCE/bin"
-mkdir -p "$DAPPER_SOURCE/dist"
+mkdir -p "./bin"
+mkdir -p "./dist"
 
 for f in ./bin/*; do
     filename=$(basename "$f")
-    if [[ $filename != *darwin* ]]; then
-        upx -o "$DAPPER_SOURCE/dist/$filename" "bin/$filename" || true
-    fi
-    if [ -f "$DAPPER_SOURCE/dist/$filename" ]; then
-        echo "UPX done!"
+    if [[ $filename != *darwin* && -z "$SKIP_COMPRESS" ]]; then
+        if upx -o "./dist/$filename" "$f"; then
+            echo "UPX done for $filename!"
+        else
+            echo "UPX failed for $filename, copying original file."
+            cp "$f" "./dist/$filename"
+        fi
     else
-        echo "Copy origin file as UPX failed!!!"
-        cp "bin/$filename" "$DAPPER_SOURCE/dist/$filename"
+        cp "$f" "./dist/$filename"
     fi
 done
-
diff --git a/scripts/release-note b/scripts/release-note
new file mode 100755
index 0000000..6504a65
--- /dev/null
+++ b/scripts/release-note
@@ -0,0 +1,42 @@
+#!/usr/bin/env sh
+
+set -e
+
+source "$(dirname $0)/version"
+cd "$(dirname $0)/.."
+
+mkdir -p dist
+TARGET_PATH="dist/release-note"
+
+if [ -z "$(command -v release-notary)" ]; then
+    echo "release-notary is not found, skip generating release notes."
+    exit 0
+fi
+
+if [ -z "${GIT_TAG}" ]; then
+    echo "running this scrpit without tag, skip generating release notes."
+    exit 0
+fi
+
+GIT_TAG=$(echo "${GIT_TAG}" | grep -E "^v([0-9]+)\.([0-9]+)(\.[0-9]+)?(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$") || true
+
+if [ "${GIT_TAG}" = "" ]; then
+    echo "git GIT_TAG is not validated, skip generating release notes."
+    exit 0
+fi
+
+for tag in $(git tag -l --sort=-v:refname); do
+    if [ "${tag}" = "${GIT_TAG}" ]; then
+        continue
+    fi
+    filterred=$(echo "${tag}" | grep -E "^v([0-9]+)\.([0-9]+)(\.[0-9]+)?(-rc[0-9]*)$") || true
+    if [ "${filterred}" = "" ]; then
+        echo "get real release tag ${tag}, stopping untag"
+        break
+    fi
+    git tag -d ${tag}
+done
+
+echo "following release notes will be published..."
+release-notary publish -d 2>/dev/null | sed '1d' | sed '$d' > $TARGET_PATH
+cat "$TARGET_PATH"