diff --git a/.github/workflows/apidiff.yml b/.github/workflows/apidiff.yml
new file mode 100644
index 000000000..7ecc34fd8
--- /dev/null
+++ b/.github/workflows/apidiff.yml
@@ -0,0 +1,20 @@
+name: apidiff
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  go-apidiff:
+    name: go-apidiff
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+    - uses: actions/setup-go@v4
+      with:
+        go-version-file: go.mod
+    - uses: joelanford/go-apidiff@main
diff --git a/.github/workflows/trusted.yml b/.github/workflows/trusted.yml
new file mode 100644
index 000000000..c0c2d082c
--- /dev/null
+++ b/.github/workflows/trusted.yml
@@ -0,0 +1,38 @@
+on:
+  workflow_run:
+    workflows: ["apidiff"]
+    types:
+      - completed
+
+permissions:
+  issues: write
+
+jobs:
+  tag-breaking-change:
+    name: Tag breaking changes
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'failure'
+    steps:
+      - name: Get PR ID
+        id: pr_id
+        run: |
+          PR_ID=$(gh pr view -R "${{ github.repository }}" "${{ github.event.workflow_run.head_repository.owner.login }}:${{ github.event.workflow_run.head_branch }}" --json "number" --jq ".number")
+          echo "pr_id=${PR_ID}" >> $GITHUB_OUTPUT
+      # - name: Output PR ID
+      #   id: pr-id
+      #   run: |
+      #     echo "${{ steps.pr_id.outputs.pr_id }}"
+      - name: Add breaking-change label
+        uses: actions/github-script@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const issue_number = ${{ steps.pr_id.outputs.pr_id }};
+            await github.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue_number,
+              labels: ['breaking-change']
+            });