@@ -0,0 +1,131 @@
+name: Cut Release
+
+# The whole release runs here; nothing is cut from a laptop.
+#
+#   1. Trigger this workflow (Actions tab, or
+#      `gh workflow run cut-release.yml -f bump=minor`). The `prepare` job runs
+#      the existing `scripts/release.sh prepare`, which bumps the version, dates
+#      the [Unreleased] changelog section, pushes `release/vX.Y.Z` and opens the
+#      release PR. Auto-merge is enabled, so the PR merges once branch
+#      protection is satisfied (checks green, review approved).
+#   2. When that PR merges, the `publish` job runs `scripts/release.sh publish`,
+#      which tags main `vX.Y.Z` and pushes the tag.
+#   3. The tag push triggers publish.yml (PyPI) and release.yml (GitHub Release),
+#      exactly as before.
+#
+# Both jobs act as the Hotdata automation GitHub App rather than GITHUB_TOKEN:
+# a PR opened or a tag pushed with GITHUB_TOKEN triggers no other workflows, so
+# the release PR would run no checks and the tag would publish nothing.
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: 'patch | minor | major | explicit X.Y.Z'
+        required: true
+        default: patch
+        type: string
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+permissions: {}
+
+concurrency:
+  group: cut-release
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    name: Open release PR
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: Iv23liKBX2RYMoZIYuKa
+          private-key: ${{ secrets.HOTDATA_AUTOMATION_PRIVATE_KEY }}
+          owner: hotdata-dev
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          fetch-depth: 0
+          fetch-tags: true
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: '3.12'
+
+      # `release.sh prepare` refreshes uv.lock when uv is on PATH, so the lock
+      # the PR carries matches the bumped version.
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      - name: Configure git identity
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          slug="${{ steps.app-token.outputs.app-slug }}[bot]"
+          id="$(gh api "/users/${slug}" --jq .id)"
+          git config user.name "$slug"
+          git config user.email "${id}+${slug}@users.noreply.github.com"
+
+      - name: Prepare release
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: ./scripts/release.sh prepare "${{ inputs.bump }}"
+
+      # Branch protection on main gates the merge on the checks and the
+      # approving review, so this only merges once everything is green.
+      - name: Enable auto-merge on the release PR
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          branch="$(git rev-parse --abbrev-ref HEAD)"
+          number="$(gh pr list --head "$branch" --state open --json number --jq '.[0].number')"
+          [[ -n "$number" ]] || { echo "::error::no open PR for $branch"; exit 1; }
+          gh pr merge "$number" --squash --auto
+          echo "Release PR #$number opened from $branch with auto-merge enabled."
+
+  publish:
+    name: Tag release
+    if: >-
+      github.event_name == 'pull_request'
+      && github.event.pull_request.merged == true
+      && startsWith(github.event.pull_request.head.ref, 'release/v')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: Iv23liKBX2RYMoZIYuKa
+          private-key: ${{ secrets.HOTDATA_AUTOMATION_PRIVATE_KEY }}
+          owner: hotdata-dev
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          ref: main
+          token: ${{ steps.app-token.outputs.token }}
+          fetch-depth: 0
+          fetch-tags: true
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: '3.12'
+
+      - name: Configure git identity
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          slug="${{ steps.app-token.outputs.app-slug }}[bot]"
+          id="$(gh api "/users/${slug}" --jq .id)"
+          git config user.name "$slug"
+          git config user.email "${id}+${slug}@users.noreply.github.com"
+
+      - name: Tag and push
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: ./scripts/release.sh publish
@@ -9,25 +9,28 @@ Every release uses `./scripts/release.sh`. Do not bump versions, tag, or create
 
 ## Release steps
 
-1. Add user-facing notes under `## [Unreleased]` in `CHANGELOG.md`.
-2. Prepare the release PR:
+Releases are cut in CI by the `Cut Release` workflow (`cut-release.yml`). It runs
+the same `./scripts/release.sh` a person would, as the Hotdata automation app.
+
+1. Make sure `## [Unreleased]` in `CHANGELOG.md` has user-facing notes.
+2. Trigger the workflow with the bump kind or an explicit version:
 
    ```bash
-   ./scripts/release.sh prepare patch   # or minor | major | 1.2.3
+   gh workflow run cut-release.yml -f bump=minor   # or patch | major | 1.2.3
    ```
 
-3. Merge the PR after CI passes (including the changelog check).
-4. Publish from a clean default branch checkout:
+   The `prepare` job runs `release.sh prepare`, which opens the
+   `release/vX.Y.Z` PR with auto-merge enabled.
+3. The PR merges on its own once CI and the review gate pass. Merging it runs
+   the `publish` job, which runs `release.sh publish` and pushes the `vX.Y.Z`
+   tag.
 
-   ```bash
-   git checkout main   # or master for hotdata-marimo
-   git pull
-   ./scripts/release.sh publish
-   ```
+That is the whole process. Running the script locally still works and does the
+same thing, but is not the normal path.
 
 ## What happens automatically
 
-Pushing a `vX.Y.Z` tag triggers two workflows:
+Pushing the `vX.Y.Z` tag triggers two workflows:
 
 | Workflow | Purpose |
 |----------|---------|
 
@@ -16,14 +16,15 @@ need() { command -v "$1" >/dev/null 2>&1 || die "$1 is required"; }
 #
 # `python3` carries no version guarantee, and this package's own requires-python
 # is >=3.10 — so hardcoding it meant the release script could not run on the
-# oldest Python the package claims to support. No workflow runs this script; only
-# a human cutting a release does, which is why it went unnoticed for so long. The
+# oldest Python the package claims to support. Until cut-release.yml, no workflow
+# ran this script; only a human cutting a release did, which is why it went
+# unnoticed for so long. The
 # symptom was a bare ModuleNotFoundError, which reads as a broken checkout rather
 # than a too-old interpreter.
 #
 # `uv` is the fallback because `prepare` below already shells out to `uv lock`
 # when a uv.lock is present, so a machine able to cut a release here already has
-# it. (CI installs with pip, so this is about the local release path only.)
+# it. (cut-release.yml installs uv for the same reason.)
 resolve_python() {
   if command -v python3 >/dev/null 2>&1 && python3 -c "import tomllib" >/dev/null 2>&1; then
     echo python3
@@ -192,9 +193,9 @@ Release **${pkg} v${new}**.
 - [x] \`CHANGELOG.md\` updated
 - [ ] CI green
 
-After merge, run \`./scripts/release.sh publish\` from a clean \`${base}\` checkout."
+Merging this PR tags the release in CI (cut-release.yml), which publishes to PyPI."
 
-  echo "Prepared ${pkg} v${new}. Merge the PR, then run: ./scripts/release.sh publish"
+  echo "Prepared ${pkg} v${new}. Once the PR merges, CI tags and publishes it."
 }
 
 cmd_publish() {