diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..afdf7d6
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,73 @@
+name: Build package
+
+on:
+  push:
+  pull_request:
+  release:
+    types:
+      - published
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  # Always build & lint package.
+  build-package:
+    name: Build & verify package
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: hynek/build-and-inspect-python-package@v2
+
+  # Publish to Test PyPI on every commit on main.
+  release-test-pypi:
+    name: Publish in-dev package to test.pypi.org
+    if: |
+      github.repository_owner == 'python'
+      && github.event_name == 'push'
+      && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    needs: build-package
+
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+
+      - name: Publish to Test PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  # Publish to PyPI on GitHub Releases.
+  release-pypi:
+    name: Publish to PyPI
+    # Only run for published releases.
+    if: |
+      github.repository_owner == 'python'
+      && github.event.action == 'published'
+    runs-on: ubuntu-latest
+    needs: build-package
+
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.gitignore b/.gitignore
index eff40d7..009c104 100644
--- a/.gitignore
+++ b/.gitignore
@@ -88,8 +88,5 @@ ENV/
 # Rope project settings
 .ropeproject
 
-# CPython checkout for cherry_picker.
-cherry_picker/cpython
-
 # pytest
 .pytest_cache/
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 0000000..13c8aa6
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,29 @@
+# Release Checklist
+
+- [ ] check tests pass on [GitHub Actions](https://github.com/python/blurb/actions)
+      [![GitHub Actions status](https://github.com/python/blurb/actions/workflows/main.yml/badge.svg)](https://github.com/python/blurb/actions/workflows/main.yml)
+
+- [ ] Update [changelog](https://github.com/python/blurb/blob/main/CHANGELOG.md)
+
+- [ ] Go to the [Releases page](https://github.com/python/blurb/releases) and
+
+  - [ ] Click "Draft a new release"
+
+  - [ ] Click "Choose a tag"
+
+  - [ ] Type the next `vX.Y.Z` version and select "**Create new tag: vX.Y.Z** on publish"
+
+  - [ ] Leave the "Release title" blank (it will be autofilled)
+
+  - [ ] Click "Generate release notes" and amend as required
+
+  - [ ] Click "Publish release"
+
+- [ ] Check the tagged [GitHub Actions build](https://github.com/python/blurb/actions/workflows/release.yml)
+      has deployed to [PyPI](https://pypi.org/project/blurb/#history)
+
+- [ ] Check installation:
+
+  ```bash
+  python -m pip uninstall -y blurb && python -m pip install -U blurb && blurb help
+  ```