diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c677b92
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Format check
+        if: runner.os == 'Linux'
+        run: test -z "$(gofmt -l cmd internal)"
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Build (CGO_ENABLED=0 — mode rilis)
+        run: CGO_ENABLED=0 go build ./cmd/tia-love
+
+      - name: Test
+        run: go test ./...
diff --git a/.goreleaser.yml b/.goreleaser.yml
new file mode 100644
index 0000000..ea65b3d
--- /dev/null
+++ b/.goreleaser.yml
@@ -0,0 +1,35 @@
+# Konfigurasi rilis tia (F-029) — dry run lokal:
+#   goreleaser release --snapshot --clean
+version: 2
+
+project_name: tia
+
+builds:
+  - id: tia-love
+    main: ./cmd/tia-love
+    binary: tia-love
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+    flags:
+      - -trimpath
+    ldflags:
+      - -s -w
+
+archives:
+  - id: default
+    formats:
+      - tar.gz
+    name_template: "tia-love_{{ .Os }}_{{ .Arch }}"
+    files:
+      - LICENSE
+      - README.md
+      - THIRD_PARTY_NOTICES.md
+
+checksums:
+  name_template: checksums.txt
diff --git a/README.md b/README.md
index e6a9654..63b4ac4 100644
--- a/README.md
+++ b/README.md
@@ -19,6 +19,19 @@ make test           # unit test
 
 Nama binary final: **`tia-love`** (nama produk tetap **tia**).
 
+## Instalasi
+
+Setelah rilis pertama tersedia:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/oxpoe/tia/main/install.sh | sh
+```
+
+Skrip mendeteksi OS/arch (Linux/macOS · amd64/arm64), memverifikasi SHA256, dan memasang
+ke `~/.local/bin/tia-love` tanpa sudo. Alternatif: unduh manual dari GitHub Releases.
+
+Rilis dibangun oleh GoReleaser — dry run lokal: `goreleaser release --snapshot --clean`.
+
 ## Struktur repo
 
 ```
diff --git a/install.sh b/install.sh
new file mode 100755
index 0000000..a057e6c
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,72 @@
+#!/bin/sh
+# tia-love — one-line installer (F-029)
+#
+#   curl -fsSL https://raw.githubusercontent.com/oxpoe/tia/main/install.sh | sh
+#
+# Mendeteksi OS/arch, mengunduh rilis terbaru dari GitHub Releases,
+# memverifikasi SHA256, lalu memasang ke ~/.local/bin (tanpa sudo).
+# Override lokasi: TIA_LOVE_INSTALL_DIR=/path
+
+set -eu
+
+REPO="oxpoe/tia"
+BIN="tia-love"
+DEST="${TIA_LOVE_INSTALL_DIR:-$HOME/.local/bin}"
+
+os=$(uname -s | tr '[:upper:]' '[:lower:]')
+arch=$(uname -m)
+case "$arch" in
+    x86_64 | amd64) arch=amd64 ;;
+    aarch64 | arm64) arch=arm64 ;;
+    *)
+        echo "tia-love: arsitektur tidak didukung: $arch" >&2
+        exit 1
+        ;;
+esac
+case "$os" in
+    linux | darwin) ;;
+    *)
+        echo "tia-love: OS tidak didukung: $os (Windows: gunakan WSL2)" >&2
+        exit 1
+        ;;
+esac
+
+echo "==> mencari rilis terbaru..."
+tag=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" |
+    grep -o '"tag_name": *"[^"]*"' | head -1 | cut -d'"' -f4)
+if [ -z "${tag:-}" ]; then
+    echo "tia-love: tidak menemukan rilis di github.com/$REPO/releases" >&2
+    exit 1
+fi
+
+tarball="${BIN}_${os}_${arch}.tar.gz"
+base="https://github.com/$REPO/releases/download/$tag"
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+echo "==> unduh $tarball ($tag)"
+curl -fsSL -o "$tmp/$tarball" "$base/$tarball"
+curl -fsSL -o "$tmp/checksums.txt" "$base/checksums.txt"
+
+echo "==> verifikasi SHA256"
+if command -v sha256sum >/dev/null 2>&1; then
+    verify="sha256sum -c -"
+else
+    verify="shasum -a 256 -c -" # macOS
+fi
+awk -v f="$tarball" '$2 == f' "$tmp/checksums.txt" |
+    (cd "$tmp" && $verify >/dev/null) || {
+    echo "tia-love: verifikasi checksum GAGAL — unduhan dibatalkan" >&2
+    exit 1
+}
+
+tar -xzf "$tmp/$tarball" -C "$tmp" "$BIN"
+mkdir -p "$DEST"
+install -m 0755 "$tmp/$BIN" "$DEST/$BIN"
+
+echo "==> terpasang: $DEST/$BIN ($tag)"
+case ":$PATH:" in
+    *":$DEST:"*) ;;
+    *) echo "catatan: $DEST belum ada di \$PATH — tambahkan, lalu buka terminal baru" ;;
+esac