diff --git a/.github/workflows/publish-deb.yml b/.github/workflows/publish-deb.yml
new file mode 100644
index 000000000..e0501b0d9
--- /dev/null
+++ b/.github/workflows/publish-deb.yml
@@ -0,0 +1,89 @@
+name: Build and Publish Package
+
+on:
+  create
+
+jobs:
+  publish_apisix:
+    name: Build and Publish deb Package
+    runs-on: ubuntu-18.04
+    timeout-minutes: 60
+    env:
+      VAR_COS_BUCKET_CI: ${{ secrets.VAR_COS_BUCKET_CI }}
+      VAR_COS_BUCKET_REPO: ${{ secrets.VAR_COS_BUCKET_REPO }}
+      VAR_COS_ENDPOINT: ${{ secrets.VAR_COS_ENDPOINT }}
+      VAR_DEB_WORKBENCH_DIR: /tmp/output
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2.3.5
+        with:
+          submodules: recursive
+
+      - name: Init basic publish env
+        run: |
+          mkdir -p "${VAR_DEB_WORKBENCH_DIR}"
+          # init env var
+          TAG_DATE=$(date +%Y%m%d)
+          echo "TAG_DATE=${TAG_DATE}" >> "$GITHUB_ENV"
+
+      - name: Extract Tags name
+        if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        id: tag_env
+        shell: bash
+        run: |
+          echo "##[set-output name=version;]$(echo ${GITHUB_REF##*/})"
+
+      - name: Extract Tags Type
+        if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        id: tag_type
+        shell: bash
+        run: |
+          echo "##[set-output name=version;]$(echo ${GITHUB_REF#refs/tags/})"
+
+      - name: Build apisix deb Package
+        if: ${{ startsWith(steps.tag_type.outputs.version, 'apisix/') }}
+        env:
+          APISIX_TAG_VERSION: ${{ steps.tag_env.outputs.version}}
+        run: |
+          # build apisix
+          make package type=deb app=apisix openresty=apisix-base checkout=${APISIX_TAG_VERSION} version=${APISIX_TAG_VERSION} image_base=debian image_tag=bullseye-slim
+          mv ./output/apisix_${APISIX_TAG_VERSION}-0~debianbullseye-slim_amd64.deb ${VAR_DEB_WORKBENCH_DIR}
+          echo "TARGET_APP=apisix" >> "$GITHUB_ENV"
+
+      - name: Build apisix-base deb Package
+        if: ${{ startsWith(steps.tag_type.outputs.version, 'apisix-base/') }}
+        env:
+          APISIX_BASE_TAG_VERSION: ${{ steps.tag_env.outputs.version}}
+        run: |
+          # build apisix-base
+          echo ${{ steps.tag_env.outputs.version}}
+          echo ${{ steps.tag_type.outputs.version}}
+          make package type=deb app=apisix-base checkout=${APISIX_BASE_TAG_VERSION} version=${APISIX_BASE_TAG_VERSION} image_base=debian image_tag=bullseye-slim
+          mv ./output/apisix-base_${APISIX_BASE_TAG_VERSION}-0~debianbullseye-slim_amd64.deb ${VAR_DEB_WORKBENCH_DIR}
+          echo "TARGET_APP=apisix-base" >> "$GITHUB_ENV"
+
+      - name: Upload apisix Artifact
+        if: ${{ startsWith(steps.tag_type.outputs.version, 'apisix/') }}
+        uses: actions/upload-artifact@v2.2.3
+        with:
+          name: "apisix_${{ steps.tag_env.outputs.version}}-0~debianbullseye-slim_amd64.deb"
+          path: "${{ env.VAR_DEB_WORKBENCH_DIR }}/apisix_${{ steps.tag_env.outputs.version}}-0~debianbullseye-slim_amd64.deb"
+
+      - name: Upload apisix-base Artifact
+        if: ${{ startsWith(steps.tag_type.outputs.version, 'apisix-base/') }}
+        uses: actions/upload-artifact@v2.2.3
+        with:
+          name: "apisix-base_${{ steps.tag_env.outputs.version}}-0~debianbullseye-slim_amd64.deb"
+          path: "${{ env.VAR_DEB_WORKBENCH_DIR }}/apisix-base_${{ steps.tag_env.outputs.version}}-0~debianbullseye-slim_amd64.deb"
+
+      - name: deb repo deps init
+        env:
+          TENCENT_COS_SECRETID: ${{ secrets.TENCENT_COS_SECRETID }}
+          TENCENT_COS_SECRETKEY: ${{ secrets.TENCENT_COS_SECRETKEY }}
+        run: |
+          sudo -E ./utils/publish-deb.sh init_cos_utils
+
+      - name: deb upload
+        run: |
+          sudo -E ./utils/publish-deb.sh repo_upload
diff --git a/utils/determine-dist.sh b/utils/determine-dist.sh
index 3441fc4a2..ad74689af 100755
--- a/utils/determine-dist.sh
+++ b/utils/determine-dist.sh
@@ -7,6 +7,9 @@ if [ "${IMAGE_BASE}" == "centos" ]
 then
     dist="el${IMAGE_TAG}"
 elif [ "${IMAGE_BASE}" == "ubuntu" ]
+then
+    dist="${IMAGE_BASE}${IMAGE_TAG}"
+elif [ "${IMAGE_BASE}" == "debian" ]
 then
     dist="${IMAGE_BASE}${IMAGE_TAG}"
 fi
diff --git a/utils/install-common.sh b/utils/install-common.sh
index aa7fe1c48..c5b21a693 100755
--- a/utils/install-common.sh
+++ b/utils/install-common.sh
@@ -39,7 +39,13 @@ install_openresty_deb() {
     DEBIAN_FRONTEND=noninteractive apt-get install -y libreadline-dev lsb-release libpcre3 libpcre3-dev libldap2-dev libssl-dev perl build-essential
     DEBIAN_FRONTEND=noninteractive apt-get -y install --no-install-recommends wget gnupg ca-certificates
     wget -O - https://openresty.org/package/pubkey.gpg | apt-key add -
-    echo "deb http://openresty.org/package/${arch_path}ubuntu $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/openresty.list
+    if [[ $IMAGE_BASE == "ubuntu" ]]; then
+        echo "deb http://openresty.org/package/${arch_path}ubuntu $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/openresty.list
+    fi
+
+    if [[ $IMAGE_BASE == "debian" ]]; then
+        echo "deb http://openresty.org/package/${arch_path}debian $(lsb_release -sc) openresty" | tee /etc/apt/sources.list.d/openresty.list
+    fi
     DEBIAN_FRONTEND=noninteractive apt-get update
     DEBIAN_FRONTEND=noninteractive apt-get install -y openresty-openssl111-dev openresty
 }
diff --git a/utils/publish-deb.sh b/utils/publish-deb.sh
new file mode 100755
index 000000000..cbe6067a0
--- /dev/null
+++ b/utils/publish-deb.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+# pre-set
+set -euo pipefail
+set -x
+
+env
+
+# =======================================
+# Runtime default config
+# =======================================
+VAR_TENCENT_COS_UTILS_VERSION=${VAR_TENCENT_COS_UTILS_VERSION:-v0.11.0-beta}
+VAR_DEB_WORKBENCH_DIR=${VAR_DEB_WORKBENCH_DIR:-/tmp/output}
+
+# =======================================
+# COS extension
+# =======================================
+func_cos_utils_install() {
+    # ${1} - COS util version
+    curl -o /usr/bin/coscli -L "https://github.com/tencentyun/coscli/releases/download/${1}/coscli-linux"
+    chmod 755 /usr/bin/coscli
+}
+
+func_cos_utils_credential_init() {
+    # ${1} - COS endpoint
+    # ${2} - COS SECRET_ID
+    # ${3} - COS SECRET_KEY
+    cat > "${HOME}/.cos.yaml" <<_EOC_
+cos:
+  base:
+    secretid: ${2}
+    secretkey: ${3}
+    sessiontoken: ""
+    protocol: https
+_EOC_
+}
+
+
+func_repo_upload() {
+    # ${1} - local path
+    # ${2} - bucket name
+    # ${3} - COS path
+    find "${1}" -type f -name "apsix_*.deb" \
+        -exec echo "upload : {}" \; \
+        -exec sh -c 'file=$(basename {}); \
+                    coscli -e "${VAR_COS_ENDPOINT}" cp {} --part-size 1000 "cos://${2}/packages/${3}/pool/main/a/apisix/${file}"' \;
+
+    find "${1}" -type f -name "apsix-base*.deb" \
+        -exec echo "upload : {}" \; \
+        -exec sh -c 'file=$(basename {}); \
+                    coscli -e "${VAR_COS_ENDPOINT}" cp {} --part-size 1000 "cos://${2}/packages/${3}/pool/main/a/apisix-base/${file}"' \;
+}
+
+# =======================================
+# publish utils entry
+# =======================================
+case_opt=$1
+
+case ${case_opt} in
+init_cos_utils)
+    func_cos_utils_install "${VAR_TENCENT_COS_UTILS_VERSION}"
+    func_cos_utils_credential_init "${VAR_COS_ENDPOINT}" "${TENCENT_COS_SECRETID}" "${TENCENT_COS_SECRETKEY}"
+    ;;
+repo_upload)
+    func_repo_upload "${VAR_DEB_WORKBENCH_DIR}" "${VAR_COS_BUCKET_REPO}" "debian"
+    ;;
+*)
+    echo "Unknown method!"
+esac