Releases are driven by git tags. Each branch's version is tracked in its .release-please-manifest.json at the project root. Tags are created exclusively by the release tag workflow and the release PR workflow, both through the release GitHub App — a ruleset blocks anyone else (admins included) from creating v* tags. Nightly tags (v<ver>-nightly.<date>) are cut every night for each branch in the workflow's matrix; a release candidate (v<ver>-rc.<n>, with n auto-incremented from origin's existing rc tags) is a manual dispatch with kind=rc; a real release (v<ver>) is a manual dispatch with kind=release. Both rc and release dispatches pause for a second person's approval. A new tag triggers the release workflow, which runs ./bootstrap.sh release to build and publish the version at that tag: npm packages to npmjs, docker images to DockerHub, and the aztec-up and playground assets to S3. The ci-release-pr label on a pull request cuts a canary release the same way: v<ver>-commit.g<sha> at the PR head, released like any other tag, with the commit channel keeping it off the shared npm dist-tags.