diff --git a/.bazelrc.jenkins b/.bazelrc.jenkins
new file mode 100644
index 00000000000..664f7b13380
--- /dev/null
+++ b/.bazelrc.jenkins
@@ -0,0 +1,8 @@
+# This is from Bazel's former travis setup, to avoid blowing up the RAM usage.
+startup --host_jvm_args=-Xmx8192m
+startup --host_jvm_args=-Xms8192m
+startup --batch
+
+# This is so we understand failures better
+build --verbose_failures
+
diff --git a/.gitignore b/.gitignore
index a6ef824c1f8..469486c8f36 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,3 @@
 /bazel-*
+.idea/*
+*.iml
diff --git a/Jenkinsfile b/Jenkinsfile
new file mode 100644
index 00000000000..db6abcaa5f4
--- /dev/null
+++ b/Jenkinsfile
@@ -0,0 +1,61 @@
+#!groovy
+
+@Library('testutils')
+
+import org.istio.testutils.Utilities
+import org.istio.testutils.GitUtilities
+import org.istio.testutils.Bazel
+
+// Utilities shared amongst modules
+def gitUtils = new GitUtilities()
+def utils = new Utilities()
+def bazel = new Bazel()
+
+node {
+  gitUtils.initialize()
+  // Proxy does build work correctly with Hazelcast.
+  // Must use .bazelrc.jenkins
+  bazel.setVars('', '')
+}
+
+mainFlow(utils) {
+  if (utils.runStage('PRESUBMIT')) {
+    def success = true
+    utils.updatePullRequest('run')
+    try {
+      presubmit(gitUtils, bazel)
+    } catch (Exception e) {
+      success = false
+      throw e
+    } finally {
+      utils.updatePullRequest('verify', success)
+    }
+  }
+  if (utils.runStage('POSTSUBMIT')) {
+    buildNode(gitUtils) {
+      bazel.updateBazelRc()
+      sh 'script/release-binary'
+    }
+  }
+}
+
+def presubmit(gitUtils, bazel) {
+  buildNode(gitUtils) {
+    stage('Code Check') {
+      sh('script/check-style')
+    }
+    bazel.updateBazelRc()
+    stage('Bazel Fetch') {
+      bazel.fetch('-k //...')
+    }
+    stage('Bazel Build') {
+      bazel.build('//...')
+    }
+    stage('Bazel Tests') {
+      bazel.test('//...')
+    }
+    stage('Push Test Binary') {
+      sh 'script/release-binary'
+    }
+  }
+}
diff --git a/script/release-binary b/script/release-binary
index af90b1aa0da..bf83a7d3115 100755
--- a/script/release-binary
+++ b/script/release-binary
@@ -24,16 +24,19 @@ set -ex
 BUCKET_NAME="istio-build/proxy"
 
 # The proxy binary name.
-BINARY_FORMAT='envoy-alpha-%H.tar.gz'
-BINARY_NAME="$(git show -q HEAD --pretty=format:"${BINARY_FORMAT}")"
+SHA="$(git rev-parse --verify HEAD)"
+BINARY_NAME="envoy-alpha-${SHA}.tar.gz"
+SHA256_NAME="envoy-alpha-${SHA}.sha256"
 
 # Build the binary
 bazel build --config=release //src/envoy/mixer:envoy_tar
-SRC="bazel-bin/src/envoy/mixer/envoy_tar.tar.gz"
-DST="gs://${BUCKET_NAME}/${BINARY_NAME}"
+BAZEL_TARGET="bazel-bin/src/envoy/mixer/envoy_tar.tar.gz"
+ln "${BAZEL_TARGET}" "${BINARY_NAME}"
+sha256sum "${BINARY_NAME}" > "${SHA256_NAME}"
+DST="gs://${BUCKET_NAME}/"
 
 # Copy it to the bucket.
-echo "Copying ${SRC} to ${DST}"
-gsutil cp ${SRC} ${DST}
+echo "Copying ${BINARY_NAME} ${SHA256_NAME} to ${DST}"
+gsutil cp "${BINARY_NAME}" "${SHA256_NAME}" "${DST}"