@@ -10,25 +10,26 @@ body:
   - type: markdown
     attributes:
       value: |
-        This checklist is for cuda-core releases as well as cuda-bindings patches. Please go through this checklist and ensure all tasks are completed. See [RELEASE-core.md](../RELEASE-core.md) for detailed guidance on each step (cuda.core).
+        This checklist is for cuda-core releases as well as cuda-bindings patches. See [RELEASE-core.md](../RELEASE-core.md) for cuda.core and [RELEASE-bindings.md](../RELEASE-bindings.md) for bindings release scope, stabilization branches, and validation.
 
   - type: checkboxes
     id: subpackage-tasks
     attributes:
       label: Tasks for cuda-core and cuda-bindings patch release
       options:
         - label: File an internal nvbug to communicate test plan & release schedule with QA
-        - label: Ensure all pending PRs are reviewed, tested, and merged
+        - label: Record the release scope and ensure all PRs selected for this release are reviewed, tested, and merged
         - label: Check (or update if needed) the dependency requirements
         - label: Sweep deprecations whose stated removal version has arrived (`grep -rn 'deprecated::' cuda_core/cuda`) and remove any that are due
         - label: "Finalize the doc update, including release notes (\"Note: Touching docstrings/type annotations in code is OK during code freeze, apply your best judgement!\")"
         - label: Update the docs for the new version
-        - label: Create a public release tag
-        - label: Wait for the tag-triggered CI run to complete, and use that run ID for release workflows (this will upload the release to PyPI)
+        - label: Record the exact source commit, workflow control revision, and selected package root before creating the approved public release tag
+        - label: Wait for the exact tag-triggered CI run to pass and complete a release dry run before approving publication
         - label: Publish the release at https://github.com/NVIDIA/cuda-python/releases (this will trigger the conda package update)
         - label: Approve the conda-package update PR
         - label: Post-release QA
         - label: Finalize the announcement update
         - label: Send out the announcement internally (on `#swcuda-python`)
         - label: Send out the announcement externally (GitHub Release -> Announcement)
-        - label: For a `cuda-bindings` release, make sure MAJOR and MAJOR-1 releases are made, as well as releases of `cuda-python` for MAJOR and MAJOR-1
+        - label: For a `cuda-bindings` release, confirm which supported release lines are in scope using `ci/versions.yml`, and release the matching `cuda-python` package for each planned line
+        - label: For a bindings stabilization or emergency branch, link the PRs returning applicable fixes to `main` and record their applicability to both bindings roots
@@ -60,15 +60,41 @@ jobs:
             echo "version=${version}"
           } >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Checkout release control plane
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Checkout release source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           # The exact tag supplies the SHA for lookup-run-id; no other tags
           # or commit history are needed.
           fetch-depth: 1
           # Resolve only the exact tag ref; checkout fails if the tag does not exist.
           ref: refs/tags/${{ steps.vars.outputs.tag }}
+          path: release-source
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install CI tool dependencies
+        run: python -m pip install -e ./ci
+
+      - name: Validate tagged release registry
+        env:
+          RELEASE_TAG: ${{ steps.vars.outputs.tag }}
+        run: |
+          # Publication can proceed after a docs failure, so reject unsupported
+          # release sources here before creating a draft or publishing artifacts.
+          python -m ci.tools.bindings_config \
+            --release-tag "$RELEASE_TAG" \
+            --release-source-root release-source
 
       - name: Check release notes exist
+        working-directory: release-source
         env:
           VERSION: ${{ steps.vars.outputs.version }}
         run: |
@@ -81,11 +107,12 @@ jobs:
 
       - name: Detect CI run ID
         id: detect-run
+        working-directory: release-source
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ steps.vars.outputs.tag }}
         run: |
-          run_id=$(./ci/tools/lookup-run-id "${TAG}" "${{ github.repository }}")
+          run_id=$(../ci/tools/lookup-run-id --tag "${TAG}" "${{ github.repository }}")
           echo "run-id=${run_id}" >> "$GITHUB_OUTPUT"
 
       - name: Create draft release
@@ -165,7 +192,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 1
-          ref: ${{ needs.prepare.outputs.tag }}
+          ref: refs/tags/${{ needs.prepare.outputs.tag }}
 
       - name: Create source archive
         run: |
@@ -175,7 +202,7 @@ jobs:
             --format=tar.gz \
             --prefix="${archive}/" \
             --output="release/${archive}.tar.gz" \
-            "${TAG}"
+            "refs/tags/${TAG}"
           sha256sum "release/${archive}.tar.gz" \
             | awk '{print $1}' > "release/${archive}.tar.gz.sha256sum"
 
 
@@ -23,14 +23,16 @@ on:
         type: boolean
         required: false
         default: false
+      bindings-package:
+        description: "Resolved CUDA bindings package JSON"
+        type: string
+        required: false
+        default: ""
 
 concurrency:
-  # Concurrency group that uses the workflow name and PR number if available
-  # or commit SHA as a fallback. If a new build is triggered under that
-  # concurrency group while a previous build is running it will be canceled.
-  # Repeated pushes to a PR will cancel all previous builds, while multiple
-  # merges to main will not cancel.
-  group: ${{ github.workflow }}-${{ github.ref_name || github.sha }}
+  # A retry may replace an upload for the same release operation. Different
+  # components, tags, and dry-run modes must not cancel one another.
+  group: ${{ github.workflow }}-${{ inputs.component }}-${{ inputs.git-tag }}-${{ inputs.dry-run }}
   cancel-in-progress: true
 
 permissions:
@@ -44,12 +46,30 @@ jobs:
     runs-on: ubuntu-latest
     env:
       ARCHIVE_NAME: ${{ github.event.repository.name }}-${{ inputs.git-tag }}
+      RELEASE_COMPONENT: ${{ inputs.component }}
+      RELEASE_GIT_TAG: ${{ inputs.git-tag }}
+      RELEASE_REPOSITORY: ${{ github.repository }}
+      RELEASE_RUN_ID: ${{ inputs.run-id }}
     steps:
-      - name: Checkout Source
+      - name: Checkout release control plane
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 1
-          ref: ${{ inputs.git-tag }}
+          fetch-tags: true
+
+      - name: Checkout release source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: refs/tags/${{ inputs.git-tag }}
+          path: release-source
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install CI tool dependencies
+        run: python -m pip install -e ./ci
 
       - name: Create Release Directory
         run: mkdir -p release
@@ -58,44 +78,56 @@ jobs:
         run: >
           git archive
           --format=tar.gz
-          --prefix="${{ env.ARCHIVE_NAME }}/"
-          --output="release/${{ env.ARCHIVE_NAME }}.tar.gz"
-          ${{ inputs.git-tag }}
+          --prefix="$ARCHIVE_NAME/"
+          --output="release/$ARCHIVE_NAME.tar.gz"
+          "refs/tags/$RELEASE_GIT_TAG"
 
       - name: Compute Checksum
         run: >
-          sha256sum "release/${{ env.ARCHIVE_NAME }}.tar.gz"
+          sha256sum "release/$ARCHIVE_NAME.tar.gz"
           | awk '{print $1}'
-          > "release/${{ env.ARCHIVE_NAME }}.tar.gz.sha256sum"
+          > "release/$ARCHIVE_NAME.tar.gz.sha256sum"
 
       - name: Upload Archive
         if: ${{ !inputs.dry-run }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: >
           gh release upload
-          --clobber "${{ inputs.git-tag }}"
-          --repo "${{ github.repository }}"
+          --clobber "$RELEASE_GIT_TAG"
+          --repo "$RELEASE_REPOSITORY"
           release/*
 
       - name: Download and Validate Wheels
         env:
+          BINDINGS_PACKAGE: ${{ inputs.bindings-package }}
           GH_TOKEN: ${{ github.token }}
         run: |
           # Use the shared script to download wheels
-          ./ci/tools/download-wheels "${{ inputs.run-id }}" "${{ inputs.component }}" "${{ github.repository }}" "release/wheels"
+          ./ci/tools/download-wheels \
+            "$RELEASE_RUN_ID" \
+            "$RELEASE_COMPONENT" \
+            "$RELEASE_REPOSITORY" \
+            "release/wheels" \
+            "$RELEASE_GIT_TAG" \
+            "$BINDINGS_PACKAGE"
 
           # Validate that release wheels match the expected version from tag.
-          ./ci/tools/validate-release-wheels "${{ inputs.git-tag }}" "${{ inputs.component }}" "release/wheels"
+          python -m ci.tools.validate_release_wheels \
+            "$RELEASE_GIT_TAG" \
+            "$RELEASE_COMPONENT" \
+            "release/wheels" \
+            --bindings-package "$BINDINGS_PACKAGE" \
+            --release-source-root release-source
 
       - name: Upload Wheels
         if: ${{ !inputs.dry-run }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           if [[ -d "release/wheels" && $(ls -A release/wheels 2>/dev/null | wc -l) -gt 0 ]]; then
-            echo "Uploading wheels to release ${{ inputs.git-tag }}"
-            gh release upload --clobber "${{ inputs.git-tag }}" --repo "${{ github.repository }}" release/wheels/*
+            echo "Uploading wheels to release $RELEASE_GIT_TAG"
+            gh release upload --clobber "$RELEASE_GIT_TAG" --repo "$RELEASE_REPOSITORY" release/wheels/*
           fi
 
       - name: Upload dry-run release artifacts