diff --git a/roles/cws-upload/tasks/main.yaml b/roles/cws-upload/tasks/main.yaml
new file mode 100644
index 0000000..aaab7a5
--- /dev/null
+++ b/roles/cws-upload/tasks/main.yaml
@@ -0,0 +1,34 @@
+- name: Check extensionId, clientId, refreshToken, workingDirectory, zipFile are set
+  when: >
+    extensionId is not defined or clientId is not defined or
+    refreshToken is not defined or workingDirectory is not defined or
+    zipFile is not defined
+  fail:
+    msg: "extensionId, clientId, refreshToken, workingDirectory and zipFile must be set"
+
+- name: Upload and publish the ZIP file to the Chrome Web Store
+  ansible.builtin.shell:
+    cmd: |
+      set -o pipefail
+      chrome-webstore-upload upload {{ '--auto-publish' if (autopublish|bool) else '' }} \
+          --extension-id {{ extensionId }} {{ '--trusted-testers' if (trustedTesters|bool) else '' }} \
+          --source {{ zipFile }} --client-id {{ clientId|quote }} \
+          --refresh-token {{ refreshToken|quote }} \
+          2>&1 | tee cws-log.txt
+    chdir: "{{ workingDirectory }}"
+    executable: /bin/bash
+  no_log: True
+  register: uploadcmd
+  failed_when: false
+
+- name: Read upload log
+  ansible.builtin.shell:
+    cmd: cat cws-log.txt
+    chdir: "{{ workingDirectory }}"
+    executable: /bin/bash
+  register: uploadlog
+
+- name: Check whether the upload was successful
+  when: "not (uploadcmd.rc == 0 or ('ITEM_NOT_UPDATABLE' in uploadlog.stdout) or ('PKG_INVALID_VERSION_NUMBER') in uploadlog.stdout)"
+  fail:
+    msg: "{{ uploadlog.stdout }}"