@@ -0,0 +1,144 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+language: en-US
+tone_instructions: |
+  Be direct, technical, brief. No praise, emojis, headings, or collapsible menus.
+  Start each comment with one prefix:
+  - suggestion: optional improvement;
+  - important: must-fix/high-impact risk;
+  - critical: blocking correctness/security/data-loss.
+
+reviews:
+  profile: chill
+
+  high_level_summary: true
+  high_level_summary_in_walkthrough: true
+  poem: false
+  in_progress_fortune: false
+  sequence_diagrams: false
+  estimate_code_review_effort: false
+  collapse_walkthrough: true
+
+  # Reduce noisy status/details sections.
+  request_changes_workflow: false
+  review_status: false
+  review_details: false
+  enable_prompt_for_ai_agents: false
+
+  auto_review:
+    enabled: true
+    drafts: false
+    base_branches:
+      - "^main$"
+    ignore_usernames:
+      - "copy-pr-bot[bot]"
+      - "dependabot[bot]"
+      - "github-actions[bot]"
+
+  tools:
+    gitleaks:
+      enabled: false
+    markdownlint:
+      enabled: false
+    shellcheck:
+      enabled: false
+
+  # Keep Autofix available, but disable the other finishing touch actions.
+  finishing_touches:
+    docstrings:
+      enabled: false
+    unit_tests:
+      enabled: false
+    simplify:
+      enabled: false
+
+  pre_merge_checks:
+    docstrings:
+      mode: "off"
+    title:
+      mode: "off"
+    description:
+      mode: "off"
+    issue_assessment:
+      mode: "off"
+    custom_checks: []
+
+  path_instructions:
+    - path: "cuda_bindings_13/**/*"
+      instructions: |
+        Focus on Cython binding correctness, API and ABI stability, error-code propagation,
+        resource ownership and reference counting, GIL handling, cross-platform behavior.
+        Avoid style-only comments already covered by pre-commit.
+
+    - path: "cuda_core/**/*"
+      instructions: |
+        Focus on Python API stability, stream ordering, CUDA resource lifetime and ownership, CUDA Array Interface
+        compatibility, host/device memory semantics, error translation, and free-threading correctness. Check that
+        public behavior changes have corresponding tests, documentation and release notes. Avoid style-only comments
+        already covered by pre-commit.
+
+    - path: "cuda_pathfinder/**/*"
+      instructions: |
+        Focus on deterministic path resolution across Linux and Windows, wheel and conda layouts, dynamic-library
+        loading and cache semantics, and explicit behavior when the CUDA Toolkit is missing or partially installed.
+        Check that errors preserve the package's public exception contracts.
+
+    - path: "cuda_python/**/*"
+      instructions: |
+        Focus on metapackage correctness, dependency and version pins, wheel and sdist contents, and documentation
+        aggregation. Keep runtime functionality in the component packages and verify that packaging changes preserve
+        compatibility among cuda-python, cuda-bindings, cuda-core, and cuda-pathfinder.
+
+    - path: "benchmarks/**/*"
+      instructions: |
+        Check that benchmark changes measure meaningful workloads, keep comparison axes and benchmark identifiers
+        comparable, avoid excessive runtime, and preserve useful comparison data.
+
+    - path: "ci/**/*"
+      instructions: |
+        For CI and build scripts, focus on matrix correctness, the GPU-versus-CPU job split, targeted build and test
+        behavior, cache and artifact handling, environment setup, clear failure modes, and avoiding unnecessary
+        expensive jobs.
+
+    - path: ".github/**/*"
+      instructions: |
+        For GitHub workflows and repository automation, focus on least-privilege permissions, event triggers, matrix
+        generation, status and check behavior, security boundaries, and avoiding unnecessary CI fanout.
+
+    - path: "**/*.pyx"
+      instructions: |
+        Focus on typed-memoryview safety, GIL and nogil correctness, exception specifications, fused-type behavior,
+        Python reference ownership, and consistency with related declarations and generated type stubs.
+
+    - path: "**/*.pxd"
+      instructions: |
+        Focus on declaration and implementation consistency, typed-memoryview safety, GIL and nogil correctness,
+        exception specifications, fused-type behavior, and API or ABI impact on Cython consumers.
+
+knowledge_base:
+  opt_out: false
+  code_guidelines:
+    filePatterns:
+      - "AGENTS.md"
+      - "CONTRIBUTING.md"
+      - "cuda_bindings_13/AGENTS.md"
+      - "cuda_core/AGENTS.md"
+      - "cuda_core/tests/AGENTS.md"
+      - "cuda_pathfinder/AGENTS.md"
+      - "cuda_python/AGENTS.md"
+      - "benchmarks/cuda_bindings/AGENTS.md"
+      - "benchmarks/cuda_core/AGENTS.md"
+      - "cuda_bindings_13/README.md"
+      - "cuda_core/README.md"
+      - "cuda_pathfinder/DESCRIPTION.rst"
+      - "cuda_python/DESCRIPTION.rst"
+      - "cuda_bindings_13/docs/source/contribute.rst"
+      - "cuda_core/docs/source/contribute.rst"
+      - "cuda_core/docs/source/concurrency.rst"
+      - "cuda_core/docs/source/error_handling.rst"
+      - "cuda_pathfinder/docs/source/contribute.rst"
+      - "cuda_bindings_13/docs/source/release.rst"
+      - "cuda_core/docs/source/release.rst"
+      - "cuda_pathfinder/docs/source/release.rst"
+      - "cuda_python/docs/source/release.rst"
@@ -14,3 +14,11 @@ pixi.lock merge=binary linguist-language=YAML linguist-generated=true
 # `setuptools-scm` to correctly determine the version when building from a git
 # archive.  See #1609.
 .git_archival.txt export-subst
+
+# cuda.core compiles against the libcu++ headers of the vendored CCCL submodule
+# only; cuda_core/MANIFEST.in grafts those headers (and their licenses) into the
+# sdist explicitly.  setuptools-scm 10 lists the files of an initialized
+# submodule, which would otherwise add the entire CCCL tree to the sdist and
+# make every egg_info walk it.  "export-ignore" makes its file finder skip the
+# submodule.  See #2940.
+cuda_core/third_party/cccl export-ignore
@@ -6,9 +6,32 @@
 This document covers the `cuda.core` release process. For other packages:
 `cuda-bindings` and `cuda-python` involve a private repository and are not
 documented here; `cuda-pathfinder` is largely automated by the
-[release-cuda-pathfinder.yml](workflows/release-cuda-pathfinder.yml)
+[CI: Release](workflows/release.yml)
 workflow.
 
+To release `cuda-pathfinder`, dispatch **CI: Release** with
+`component` set to `cuda-pathfinder`, `release-action` set
+to `full-release`, and `git-tag` set to the existing
+`cuda-pathfinder-v<VERSION>` tag. The workflow finds the successful
+tag-triggered CI run, checks release notes, creates or reuses a draft,
+builds and deploys versioned docs, and uploads the source archive, checksum,
+and wheels. It publishes to TestPyPI, verifies installation and the imported
+version, then publishes to PyPI and verifies again before publishing the
+GitHub Release without marking it as latest. A failed
+docs build prevents asset uploads, package publication, and finalization.
+
+The release-note checker runs from `git-tag`, not the workflow revision.
+For Pathfinder, that tag must contain a version
+of `ci/tools/check_release_notes.py` that writes `version=<VERSION>` to
+`GITHUB_OUTPUT`. The release-notes job rejects an empty version before
+documentation, asset uploads, or package publication can start. Pathfinder
+package publication also requires successful draft metadata preparation.
+
+The default `dry-run` action validates preparation, builds docs, and
+collects release artifacts without creating a GitHub Release or publishing
+packages. It can be dispatched from a development branch; use
+`dry-run-docs-branch` only when a preview deployment is needed.
+
 Each section below provides detailed guidance for a step in the
 [Release Checklist](ISSUE_TEMPLATE/release_checklist.yml). To start a
 release, create a new issue from that template and work through it item by
@@ -62,9 +85,14 @@ platforms as appropriate for each release.
 ## Check (or update if needed) the dependency requirements
 
 Review `cuda_core/pyproject.toml` and verify that all dependency
-requirements are current.
-
-Update the cuda_core dependency in `cuda_python/setup.py`.
+requirements are current. The `cu12`/`cu13` extras declare the
+`cuda-bindings` floors; see "Bumping the cuda-bindings floor" in
+`cuda_core/AGENTS.md`.
+
+Update the `cuda-core` pin in `cuda_python/setup.py` to the new minor
+series (`cuda-core~=X.Y.0`), and plan a `cuda-python` release right after
+this one. Until that release, `pip install cuda-python` resolves to the
+previous `cuda-core`.
 
 ---
 
 
@@ -12,6 +12,23 @@ self-hosted-runner:
 # GitHub supports queued concurrency runs, but the latest actionlint release
 # does not yet recognize the concurrency.queue key.
 paths:
+  ".github/workflows/build-docs.yml":
+    ignore:
+      - 'unexpected key "queue" for "concurrency" section'
+  ".github/workflows/cleanup-pr-previews.yml":
+    ignore:
+      - 'unexpected key "queue" for "concurrency" section'
   ".github/workflows/ci-workflow-health.yml":
     ignore:
       - 'unexpected key "queue" for "concurrency" section'
+  # GitHub supports self-repository ($/) action references, but the latest
+  # actionlint release does not yet recognize them (rhysd/actionlint#711).
+  ".github/workflows/release.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
+  ".github/workflows/test-wheel-linux.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
+  ".github/workflows/test-wheel-windows.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
@@ -1,9 +1,9 @@
-# SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 #
 # SPDX-License-Identifier: Apache-2.0
 
 name: Docs in PRs
-description: Preview or clean up docs built from PRs
+description: Preview docs built from PRs
 
 # A re-implementation based on the logic of https://github.com/rossjrw/pr-preview-action/blob/41a957c44a456a34718e9bcf825363194db5e6d5/README.md, due to limitations illustrated in NVIDIA/cuda-python#380.
 
@@ -18,20 +18,23 @@ inputs:
 runs:
   using: composite
   steps:
-    # The steps below are executed only when testing in a PR.
-    # Note: the PR previews will be removed once merged to main or release/* (see below)
     - name: Deploy doc preview
-      if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
+      if: ${{ startsWith(github.ref_name, 'pull-request/') }}
       uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f  # v4.8.0
       with:
         git-config-name: cuda-python-bot
         git-config-email: [email protected]
         folder: ${{ inputs.source-folder }}
         target-folder: docs/pr-preview/pr-${{ inputs.pr-number }}/
         commit-message: "Deploy doc preview for PR ${{ inputs.pr-number }} (${{ github.sha }})"
+        # Every PR preview, the main docs deploy, and the coverage deploy commit to
+        # the shared gh-pages branch. Rebase onto a deployment that landed in the
+        # meantime instead of force-pushing over it, which the branch ruleset
+        # rejects (and which used to discard the other deployment).
+        force: false
 
     - name: Leave a comment after deployment
-      if: ${{ github.ref_name != 'main' && !startsWith(github.ref_name, 'release/') }}
+      if: ${{ startsWith(github.ref_name, 'pull-request/') }}
       uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff  # v3.0.3
       with:
         header: pr-preview
@@ -45,27 +48,3 @@ runs:
           | <br> https://nvidia.github.io/cuda-python/pr-preview/pr-${{ inputs.pr-number }}/cuda-bindings/ <br>
           | <br> https://nvidia.github.io/cuda-python/pr-preview/pr-${{ inputs.pr-number }}/cuda-pathfinder/ <br><br>
           | <h6><br> Preview will be ready when the GitHub Pages deployment is complete. <br><br></h6>
-
-    # The steps below are executed only when building on main or release/*.
-    - name: Remove doc preview
-      if: ${{ github.ref_name == 'main' || startsWith(github.ref_name, 'release/') }}
-      uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f  # v4.8.0
-      with:
-        git-config-name: cuda-python-bot
-        git-config-email: [email protected]
-        folder: ${{ inputs.source-folder }}
-        target-folder: docs/pr-preview/pr-${{ inputs.pr-number }}/
-        commit-message: "Clean up doc preview for PR ${{ inputs.pr-number }} (${{ github.sha }})"
-
-    - name: Leave a comment after removal
-      if: ${{ github.ref_name == 'main' || startsWith(github.ref_name, 'release/') }}
-      uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff  # v3.0.3
-      with:
-        header: pr-preview
-        number: ${{ inputs.pr-number }}
-        hide_and_recreate: true
-        hide_classify: "OUTDATED"
-        message: |
-          Doc Preview CI
-          :---:
-          Preview removed because the pull request was closed or merged.
@@ -0,0 +1,70 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Download artifact (with retry)
+
+description: >-
+  Wrapper around actions/download-artifact that retries once after a short
+  delay when the first attempt fails.  Designed to absorb transient
+  infrastructure flakes such as "other side closed" without failing the job.
+
+inputs:
+  name:
+    description: "Name of the artifact to download"
+    required: true
+  path:
+    description: "Destination path for the downloaded artifact"
+    required: true
+  run-id:
+    description: >-
+      The run ID of the workflow run that uploaded the artifact.  Only used
+      together with github-token; leave empty to download from the current run.
+    required: false
+    default: ""
+  github-token:
+    description: >-
+      Token used to download from another run or repository.  Leave empty (the
+      default) to download from the current run, which uses
+      actions/download-artifact's internal download path.  That path is not the
+      same as the one used when a token is given, so do not default this to
+      github.token.
+    required: false
+    default: ""
+  retry-delay-seconds:
+    description: "Seconds to wait between the first failure and the retry"
+    required: false
+    default: "15"
+
+runs:
+  using: composite
+  steps:
+    - name: Download artifact (attempt 1)
+      id: attempt1
+      continue-on-error: true
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+      with:
+        name: ${{ inputs.name }}
+        path: ${{ inputs.path }}
+        run-id: ${{ inputs.run-id }}
+        github-token: ${{ inputs.github-token }}
+
+    - name: Wait before retry
+      if: ${{ steps.attempt1.outcome == 'failure' }}
+      shell: bash --noprofile --norc -euo pipefail {0}
+      env:
+        # Pass through env instead of interpolating the input into the shell
+        # script, so a non-numeric value cannot inject commands.
+        RETRY_DELAY_SECONDS: ${{ inputs.retry-delay-seconds }}
+      run: |
+        echo "::warning::Artifact download failed (attempt 1); retrying in ${RETRY_DELAY_SECONDS}s"
+        sleep "$RETRY_DELAY_SECONDS"
+
+    - name: Download artifact (attempt 2)
+      if: ${{ steps.attempt1.outcome == 'failure' }}
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+      with:
+        name: ${{ inputs.name }}
+        path: ${{ inputs.path }}
+        run-id: ${{ inputs.run-id }}
+        github-token: ${{ inputs.github-token }}