diff --git a/.github/workflows/command-dispatch.yml b/.github/workflows/command-dispatch.yml
index e97c7ec0a..7de91a5d9 100644
--- a/.github/workflows/command-dispatch.yml
+++ b/.github/workflows/command-dispatch.yml
@@ -37,7 +37,9 @@ jobs:
       uses: actions/checkout@v3
     - uses: peter-evans/slash-command-dispatch@v2
       with:
-        commands: run-acceptance-tests
+        commands: |
+          run-acceptance-tests
+          release
         issue-type: pull-request
         permission: write
         reaction-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 000000000..faeccf37c
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,69 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
+name: lint
+
+on:
+  workflow_call:
+    inputs: {}
+
+env:
+  DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }}
+  DATADOG_APP_KEY: ${{ secrets.DATADOG_APP_KEY }}
+  DOTNETVERSION: |
+      6.0.x
+      3.1.301
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GOVERSION: 1.21.x
+  JAVAVERSION: "11"
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODEVERSION: 16.x
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
+  PYTHONVERSION: "3.9"
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  TF_APPEND_USER_AGENT: pulumi
+  TRAVIS_OS_NAME: linux
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v3
+    - name: Install go
+      uses: actions/setup-go@v4
+      with:
+        # The versions of golangci-lint and setup-go here cross-depend and need to update together.
+        go-version: 1.21
+        # Either this action or golangci-lint needs to disable the cache
+        cache: false
+    - name: disarm go:embed directives to enable lint
+      continue-on-error: true # this fails if there are no go:embed directives
+      run: |
+        git grep -l 'go:embed' -- provider | xargs sed -i 's/go:embed/ goembed/g'
+    - name: prepare upstream
+      continue-on-error: true
+      run: make upstream
+    - name: golangci-lint
+      uses: golangci/golangci-lint-action@v3
+      with:
+        version: v1.54.1
+        working-directory: provider
+    - if: failure() && github.event_name == 'push'
+      name: Notify Slack
+      uses: 8398a7/action-slack@v3
+      with:
+        author_name: Failure in linting provider
+        fields: repo,commit,author,action
+        status: ${{ job.status }}
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 735da077b..b57e5bde4 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -314,6 +314,24 @@ jobs:
       if: failure()
       name: Send Publish Failure To Slack
       uses: rtCamp/action-slack-notify@v2
+
+  tag_release_if_labeled_needs_release:
+    name: Tag release if labeled as needs-release
+    needs: publish_sdk
+    runs-on: ubuntu-latest
+    steps:
+    - name: check if this commit needs release
+      uses: pulumi/action-release-by-pr-label@main
+      with:
+        command: "release-if-needed"
+        repo: ${{ github.repository }}
+        commit: ${{ github.sha }}
+        slack_channel: ${{ secrets.RELEASE_OPS_SLACK_CHANNEL }}
+      env:
+        RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
+        RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   test:
     name: test
     needs: build_sdk
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 82e8e0b20..5f12bc851 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -286,6 +286,26 @@ jobs:
     - name: Add SDK version tag
       run: git tag "sdk/v$(pulumictl get version --language generic)" && git push origin
         "sdk/v$(pulumictl get version --language generic)"
+
+  clean_up_release_labels:
+    name: Clean up release labels
+    needs: create_docs_build
+    
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v3
+    - name: Unshallow clone for PR merge bases
+      run: git fetch --prune --unshallow --tags
+    - name: Clean up release labels
+      uses: pulumi/action-release-by-pr-label@main
+      with:
+        command: "clean-up-release-labels"
+        repo: ${{ github.repository }}
+        commit: ${{ github.sha }}
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   test:
     name: test
     needs: build_sdk
diff --git a/.github/workflows/release_command.yml b/.github/workflows/release_command.yml
new file mode 100644
index 000000000..8b39c586b
--- /dev/null
+++ b/.github/workflows/release_command.yml
@@ -0,0 +1,43 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
+name: release-command
+on:
+  repository_dispatch:
+    types:
+    - release-command
+jobs:
+  should_release:
+    name: Should release PR
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v3
+    - name: Should release PR
+      uses: pulumi/action-release-by-pr-label@main
+      with:
+        command: "should-release"
+        repo: ${{ github.repository }}
+        pr: ${{ github.event.client_payload.pull_request.number }}
+        version: ${{ github.event.client_payload.slash_command.args.all }}
+        slack_channel: ${{ secrets.RELEASE_OPS_STAGING_SLACK_CHANNEL }}
+      env:
+        RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
+        RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - if: failure()
+      name: Notify failure
+      uses: peter-evans/create-or-update-comment@v2
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
+        issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
+        body: |
+          "release command failed: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+    - if: success()
+      name: Notify success
+      uses: peter-evans/create-or-update-comment@v2
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
+        comment-id: ${{ github.event.client_payload.github.payload.comment.id }}
+        reaction-type: hooray
diff --git a/.gitignore b/.gitignore
index 46bef8606..959c6e7a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,6 @@ sdk/java/.gradle
 sdk/java/gradle
 sdk/java/gradlew
 sdk/java/gradlew.bat
+
+
+sdk/python/venv