diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 6e8f081..c96d7f9 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - master
 
+env:
+  NODE_ENV: production
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/build.sh b/build.sh
new file mode 100644
index 0000000..4712e2b
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+if ! (set -o pipefail 2>/dev/null); then
+  # dash does not support pipefail
+  set -ex
+else
+  set -ex -o pipefail
+fi
+
+export PATH="$PATH:./node_modules/.bin"
+
+hexo generate
+
+# deploy site assets
+if [ "$NODE_ENV" = "production" ] && [ -d "public/" ]; then
+  git clone --depth 1 --branch site https://gitlab.com/curben/blog.git site
+  cp -r site/* "public/"
+  rm -f "public/README.md"
+fi
diff --git a/package.json b/package.json
index 05c9fdd..5214b89 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
     "version": "7.3.0"
   },
   "scripts": {
-    "build": "hexo generate",
+    "build": "sh build.sh",
     "snyk": "snyk auth $SNYK_TOKEN && snyk-protect && snyk test && snyk monitor",
     "renovate": "renovate --platform 'gitlab' --autodiscover false --onboarding false --update-lock-files false --labels 'renovate' --require-config='ignored' \"$CI_PROJECT_PATH\"",
     "deploy-cf-images": "npx wrangler deploy"