diff --git a/.github/workflows/publish-on-tag.yml b/.github/workflows/publish-on-tag.yml
index 5ee91fb2348..9487bbf38d7 100644
--- a/.github/workflows/publish-on-tag.yml
+++ b/.github/workflows/publish-on-tag.yml
@@ -1,8 +1,5 @@
 name: publish-on-tag
 
-# Declare default permissions as read only.
-permissions: read-all
-
 on:
   push:
     tags:
@@ -11,6 +8,7 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions: read-all
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -37,3 +35,30 @@ jobs:
           npm config set registry 'https://wombat-dressing-room.appspot.com/'
           npm config set '//wombat-dressing-room.appspot.com/:_authToken' '${NPM_TOKEN}'
           npm publish
+
+  post-publish:
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read|write
+      contents: read|write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Append `-post` to version
+        id: post-version
+        run: |
+          npm version --no-git-tag-version --no-commit-hooks "$(jq -r .version ./package.json)-post"
+          echo ::set-output name=VERSION::$(jq -r .version ./package.json)
+      - name: Build
+        run: |
+          npm install
+          npm run build
+          npm run doc
+      - name: Commit and push
+        run: |
+          git config user.name 'Github'
+          git config user.email '<noreply@github.com>'
+          git add -A
+          git commit -m "chore: bump version to ${{ steps.post-version.outputs.VERSION }}"
+          git push