diff --git a/.drone.yml b/.drone.yml
new file mode 100644
index 0000000..3b76551
--- /dev/null
+++ b/.drone.yml
@@ -0,0 +1,38 @@
+kind: pipeline
+type: docker
+name: default
+
+when:
+  event:
+  - push
+  - pull_request
+  - tag
+
+steps:
+
+- name: test
+  image: rust:1.81-bookworm
+  commands:
+  - cargo test --verbose --all
+
+- name: build (wasm_pack)
+  image: rust:1.81-bookworm
+  commands:
+  - curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+  - (cd um_wasm && wasm-pack build --release --target web --out-dir ../um_wasm_loader/pkg)
+
+- name: build (node)
+  image: node:22.9-bookworm
+  environment:
+    NPM_TOKEN:
+      from_secret: NPM_TOKEN
+    COREPACK_ENABLE_AUTO_PIN: 0
+    BUILD_SKIP_WASM_PACK: 1
+  depends_on:
+    - "build (wasm_pack)"
+  commands:
+  - corepack enable
+  - cd um_wasm_loader
+  - pnpm i
+  - pnpm build
+  - ./ci_publish.sh
diff --git a/.gitignore b/.gitignore
index 7b3cd89..e4541e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,5 @@ target/
 pkg/
 pkg-*/
 node_modules/
+.pnpm-store
 *.local
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..9606bc3
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,18 @@
+FROM rust:1.81-bookworm
+
+RUN curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+ARG uid=1998
+ARG gid=1998
+
+RUN groupadd -g "$gid" builder \
+    && useradd -u "$uid" -g "$gid" -m -d /h builder
+
+USER builder
+
+RUN curl -fsL https://get.pnpm.io/install.sh | ENV="$HOME/.bashrc" SHELL="$(which bash)" bash -
+RUN git config --global --add safe.directory /a
+ENV PATH="/h/.local/share/pnpm:$PATH"
+
+WORKDIR /a
+CMD ["/usr/bin/sleep", "infinity"]
diff --git a/build.sh b/build.sh
new file mode 100755
index 0000000..0b23d7a
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,35 @@
+#!/bin/bash -ex
+
+docker volume create umc_rust_cache
+docker volume create umc_rust_pnpm_cache
+docker volume create umc_rust_target_cache
+docker volume create umc_pnpm_loader_cache
+docker buildx build --build-arg uid="$(id -u)" --build-arg gid="$(id -g)" -t umc_rust .
+
+run_container() {
+    docker run -d \
+        -v umc_rust_cache:/h/.cargo \
+        -v "${PWD}:/a" \
+        -v umc_rust_pnpm_cache:/a/.pnpm-store \
+        -v umc_rust_target_cache:/a/target \
+        -v umc_pnpm_loader_cache:/a/um_wasm_loader/node_modules \
+        umc_rust
+}
+
+umc_rust_id="$(run_container)"
+
+docker exec -i -u root "${umc_rust_id}" chown "$(id -u):$(id -g)" \
+    /h/.cargo \
+    /a/.pnpm-store \
+    /a/target \
+    /a/um_wasm_loader/node_modules
+
+docker exec -i "${umc_rust_id}" bash <<'EOF'
+    export npm_config_use_node_version=22.9.0
+    cd um_wasm_loader
+    pnpm --package-import-method=copy i
+    pnpm build
+    pnpm pack
+EOF
+docker stop "${umc_rust_id}"
+docker rm -f "${umc_rust_id}"
diff --git a/um_wasm_loader/build.js b/um_wasm_loader/build.js
index 605c6d1..90c0a12 100644
--- a/um_wasm_loader/build.js
+++ b/um_wasm_loader/build.js
@@ -77,12 +77,15 @@ async function main() {
   const wasmSourceDir = path.join(__dirname, '..', 'um_wasm');
   const wasmOutDir = path.resolve(__dirname, 'pkg');
   const wasmDistDir = path.resolve(__dirname, 'dist');
-  await rm(wasmOutDir, { recursive: true, force: true });
   const wasmRelOutDir = path.relative(wasmSourceDir, wasmOutDir);
   const profileFlag = parseBoolean(process.env.BUILD_RELEASE, true) ? '--release' : '--dev';
-  await run(['wasm-pack', 'build', profileFlag, '--target', 'web', '--out-dir', wasmRelOutDir], {
-    cwd: path.resolve(__dirname, '..', 'um_wasm'),
-  });
+
+  if (process.env.BUILD_SKIP_WASM_PACK !== '1') {
+    await rm(wasmOutDir, { recursive: true, force: true });
+    await run(['wasm-pack', 'build', profileFlag, '--target', 'web', '--out-dir', wasmRelOutDir], {
+      cwd: path.resolve(__dirname, '..', 'um_wasm'),
+    });
+  }
 
   // Remove unneeded files
   await Promise.all([
@@ -93,7 +96,7 @@ async function main() {
   ]);
 
   const homeDir = os.homedir();
-  const dummyHome = '/h' + homeDir.slice(3).replace(/./g, '_') + '/';
+  const dummyHome = '/h' + homeDir.slice(2).replace(/./g, '_');
 
   // Patch some files...
   await Promise.all([
diff --git a/um_wasm_loader/ci_publish.sh b/um_wasm_loader/ci_publish.sh
new file mode 100755
index 0000000..e4f12fd
--- /dev/null
+++ b/um_wasm_loader/ci_publish.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [[ -z "${DRONE_TAG}" ]]; then
+    echo "skip package publish, pack only."
+    pnpm pack
+    exit 0
+fi
+
+echo '//git.unlock-music.dev/api/packages/um/npm/:_authToken=${NPM_TOKEN}' > $HOME/.npmrc
+pnpm publish --access=public --no-git-checks
diff --git a/um_wasm_loader/package.json b/um_wasm_loader/package.json
index 713575a..b6323ab 100644
--- a/um_wasm_loader/package.json
+++ b/um_wasm_loader/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@unlock-music/crypto",
-  "version": "0.0.0-alpha.18",
+  "version": "0.0.0-alpha.19",
   "description": "Project Unlock Music: 加解密支持库",
   "scripts": {
     "build": "node build.js",