diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000000..55bf587581
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,35 @@
+name: Release cumulusci
+
+on:
+  push:
+    branches:
+    - master
+    paths:
+    - cumulusci/version.txt
+
+jobs:
+  publish-to-pypi:
+    name: Publish new release to PyPI
+    runs-on: ubuntu-18.04
+    steps:
+      - uses: actions/checkout@master
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.8
+      - name: Install build tools
+        run: python -m pip install twine wheel
+      - name: Build source tarball and binary wheel
+        run: python setup.py sdist bdist_wheel
+      - name: Upload to PyPI
+        run: twine upload dist/*
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+      - name: Create tag
+        run: |
+          git tag -a -m "version $(python setup.py --version)" v$(python setup.py --version)
+          git push --follow-tags
+
+# to do:
+# - add release notes in github
diff --git a/HISTORY.rst b/HISTORY.rst
index a394c4958a..be69827b4d 100644
--- a/HISTORY.rst
+++ b/HISTORY.rst
@@ -2,6 +2,48 @@
 History
 =======
 
+3.9.0 (2020-03-16)
+------------------
+
+Critical changes:
+
+* The ``update_admin_profile`` task can now add field-level permissions for all packaged objects.
+  This behavior is the default for projects with ``minimum_cumulusci_version`` >= 3.9.0 that are
+  not using the ``package_xml`` option. Other projects can opt into it using the
+  ``include_packaged_objects`` option.
+
+  The Python class used for this task has been renamed to ``ProfileGrantAllAccess`` and refactored
+  to use the Metadata ETL framework. This is a breaking change for custom tasks that subclassed
+  ``UpdateAdminProfile`` or ``UpdateProfile``.
+
+* Refactored how CumulusCI uses the Bulk API to load, extract, and delete data sets.
+  These changes should have no functional impact, but projects that subclass
+  CumulusCI's bulk data tasks should carefully review the changes.
+
+Changes:
+
+* New projects created using ``cci project init`` will now get set up with scratch org settings to:
+
+  * Use the Enhanced Profile Editor
+  * Allow logging in as another user
+  * _not_ force relogin after Login-As
+
+* If ``cumulusci.yml`` contains non-breaking spaces in indentation,
+  they will be automatically converted to normal spaces.
+
+* Bulk data tasks:
+
+  * Added improved validation that mapping files are in the expected format.
+
+  * When using the ``ignore_row_errors`` option, warnings will be suppressed after the 10th row with errors.
+
+Issues closed:
+
+* The ``github_release`` task now validates the ``commit`` option to make sure it is in the right format.
+
+* If there is an error from ``sfdx`` while using the ``retrieve_changes`` task, it will now be logged.
+
+
 3.8.0 (2020-02-28)
 ------------------
 
diff --git a/cumulusci/tasks/salesforce/update_profile.py b/cumulusci/tasks/salesforce/update_profile.py
index a9160bc0a7..5553e8e36d 100644
--- a/cumulusci/tasks/salesforce/update_profile.py
+++ b/cumulusci/tasks/salesforce/update_profile.py
@@ -47,7 +47,7 @@ class ProfileGrantAllAccess(MetadataSingleEntityTransformTask):
         },
         "include_packaged_objects": {
             "description": "Automatically include objects from all installed managed packages. "
-            "Defaults to True in projects that require CumulusCI 3.8.1 and greater that don't use a custom package.xml, otherwise False."
+            "Defaults to True in projects that require CumulusCI 3.9.0 and greater that don't use a custom package.xml, otherwise False."
         },
         "api_names": {"description": "List of API names of Profiles to affect"},
     }
@@ -80,13 +80,13 @@ def _init_options(self, kwargs):
 
         # We enable new functionality to extend the package.xml to packaged objects
         # by default only if we meet specific requirements: the project has to require
-        # CumulusCI >= 3.8.1 (i.e., creation date or opt-in after release), and it must
+        # CumulusCI >= 3.9.0 (i.e., creation date or opt-in after release), and it must
         # not be using a custom `package.xml`
         min_cci_version = self.project_config.minimum_cumulusci_version
         if min_cci_version and "package_xml" not in self.options:
             parsed_version = pkg_resources.parse_version(min_cci_version)
             default_packages_arg = parsed_version >= pkg_resources.parse_version(
-                "3.8.1"
+                "3.9.0"
             )
         else:
             default_packages_arg = False
diff --git a/cumulusci/version.txt b/cumulusci/version.txt
index 0be1fc7d24..b72ad011fa 100644
--- a/cumulusci/version.txt
+++ b/cumulusci/version.txt
@@ -1 +1 @@
-3.8.0
\ No newline at end of file
+3.9.0
\ No newline at end of file
diff --git a/docs/install.rst b/docs/install.rst
index 2d1902c1aa..19bad64507 100644
--- a/docs/install.rst
+++ b/docs/install.rst
@@ -102,7 +102,7 @@ is installed correctly by running ``cci version``:
 .. code:: console
 
    $ cci version
-    CumulusCI version: 3.8.0 (/path/to/bin/cci)
+    CumulusCI version: 3.9.0 (/path/to/bin/cci)
     Python version: 3.7.4 (/path/to/bin/python)
 
     You have the latest version of CumulusCI.
diff --git a/docs/tasks.rst b/docs/tasks.rst
index 8263b25b27..5bf6b9d0ba 100644
--- a/docs/tasks.rst
+++ b/docs/tasks.rst
@@ -3063,7 +3063,7 @@ Options
 ``-o include_packaged_objects INCLUDEPACKAGEDOBJECTS``
 	 *Optional*
 
-	 Automatically include objects from all installed managed packages. Defaults to True in projects that require CumulusCI 3.8.1 and greater that don't use a custom package.xml, otherwise False.
+	 Automatically include objects from all installed managed packages. Defaults to True in projects that require CumulusCI 3.9.0 and greater that don't use a custom package.xml, otherwise False.
 
 ``-o api_names APINAMES``
 	 *Optional*
diff --git a/setup.py b/setup.py
index b007cc48c2..cc9a840a11 100644
--- a/setup.py
+++ b/setup.py
@@ -14,7 +14,7 @@ def find_packages(path=["."], prefix=""):
             yield name
 
 
-with open(os.path.join("cumulusci", "version.txt")) as version_file:
+with open(os.path.join("cumulusci", "version.txt"), "r") as version_file:
     version = version_file.read().strip()
 
 with open("README.rst", "rb") as readme_file:
diff --git a/utility/build-homebrew.sh b/utility/build-homebrew.sh
index b125ea0bbe..5dc2877d20 100755
--- a/utility/build-homebrew.sh
+++ b/utility/build-homebrew.sh
@@ -12,7 +12,7 @@ echo " "
 curl -L "https://pypi.io/pypi/cumulusci/json" > "$PYPI_JSON" || exit 1
 PACKAGE_URL="$(cat "$PYPI_JSON" | jq '.urls[1].url')" || exit 1
 PACKAGE_SHA="$(cat "$PYPI_JSON" | jq '.urls[1].digests.sha256')" || exit 1
-PACKAGE_VERSION="$(cat setup.cfg | grep current_version | head -n 1 | cut -f 3 -d' ')" || exit 1
+PACKAGE_VERSION="$(cat cumulusci/version.txt)"
 
 echo " "
 echo "=> Creating a temporary virtualenv and installing CumulusCI..."
@@ -21,12 +21,12 @@ source deactivate
 python3.7 -m venv "$ENV_DIR" || exit 1
 source "$ENV_DIR/bin/activate" || exit 1
 pip install -U pip
-pip install --no-cache cumulusci==$PACKAGE_VERSION homebrew-pypi-poet || exit 1
+pip install --no-cache-dir cumulusci==$PACKAGE_VERSION homebrew-pypi-poet || exit 1
 
 echo " "
 echo "=> Collecting dependencies and generating resource stanzas..."
 echo " "
-poet cumulusci > "$RES_FILE"
+poet cumulusci | awk '/resource "cumulusci"/{c=5} !(c&&c--)' > "$RES_FILE"
 if [ $? -ne 0 ]; then
    exit 1
 fi
@@ -53,6 +53,8 @@ $(cat "$RES_FILE")
     site_packages = libexec/"lib/python#{xy}/site-packages"
     ENV.prepend_create_path "PYTHONPATH", site_packages
 
+    system "python3", *Language::Python.setup_install_args(libexec)
+
     deps = resources.map(&:name).to_set
     deps.each do |r|
       resource(r).stage do