diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
new file mode 100644
index 0000000..b0f05fa
--- /dev/null
+++ b/.github/workflows/actionlint.yaml
@@ -0,0 +1,26 @@
+name: actionlint
+
+on:
+  pull_request:
+    branches: [prod-staging]
+    paths:
+      - '.github/workflows/**'
+
+# Automatically cancel in-progress actions on the same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install action linter
+        run: |
+          mkdir -p "$HOME"/.local/bin
+          curl -sL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash | bash -s -- latest "$HOME"/.local/bin
+
+      - name: Check that all workflows are valid
+        run: actionlint -verbose
diff --git a/.github/workflows/check-pr.yaml b/.github/workflows/check-pr.yaml
new file mode 100644
index 0000000..47ea46d
--- /dev/null
+++ b/.github/workflows/check-pr.yaml
@@ -0,0 +1,81 @@
+name: check/pr
+
+on:
+  pull_request:
+    types: [ opened, synchronize, reopened ]
+    branches: [ prod-staging ]
+
+permissions:
+  contents: read
+
+jobs:
+  commits:
+    runs-on: ubuntu-latest
+    steps:
+    - name: format
+      if: always()
+      uses: taskmedia/action-conventional-commits@v1.1.20
+      with:
+        types: "build|ci|docs|feat|fix|perf|refactor|style|test|revert|chore|sync"
+        token: ${{ secrets.GH_PAT }}
+
+    - name: length
+      if: ${{ github.actor != 'dependabot' && github.actor != 'dependabot[bot]' }}
+      uses: gsactions/commit-message-checker@v2
+      with:
+        pattern: '((^(?=(?:.|\n)*(?:^|\n)\[\d\]: .{69,}(?:$|\n)(?:.|\n)*)(?:.|\n)*$)|(^(?!(?:.|\n)*(?:^|\n).{74,}(?:$|\n)(?:.|\n)*)(?:.|\n)*$))'
+        flags: ''
+        error: 'The maximum line length of 74 characters is exceeded.'
+        excludeDescription: 'true'
+        excludeTitle: 'true'
+        checkAllCommitMessages: 'true'
+        accessToken: ${{ secrets.GH_PAT }}
+
+    - name: signed-off-by
+      if: always()
+      uses: gsactions/commit-message-checker@v2
+      with:
+        pattern: '^Signed-off-by: .+ \<.+\@.+\..+\>$'
+        error: 'Signed-off-by line is missing.'
+        excludeDescription: 'true'
+        excludeTitle: 'true'
+        checkAllCommitMessages: 'true'
+        accessToken: ${{ secrets.GH_PAT }}
+
+  pr:
+    runs-on: ubuntu-latest
+    steps:
+    - name: title-format
+      if: always()
+      uses: gsactions/commit-message-checker@v2
+      with:
+        pattern: '^(build|ci|docs|feat|fix|perf|refactor|style|test|revert|chore|sync)(\([\w\-\_\d]+\))?!?: '
+        error: 'The PR title must follow the conventional commits format.'
+        excludeDescription: 'true'
+        excludeTitle: 'false'
+        checkAllCommitMessages: 'false'
+        accessToken: ${{ secrets.GH_PAT }}
+
+    - name: title-length
+      if: ${{ github.actor != 'dependabot' && github.actor != 'dependabot[bot]' }}
+      uses: gsactions/commit-message-checker@v2
+      with:
+        pattern: '^(?!.{75,}).*'
+        flags: ''
+        error: 'The maximum line length of 75 characters is exceeded.'
+        excludeDescription: 'true'
+        excludeTitle: 'false'
+        checkAllCommitMessages: 'false'
+        accessToken: ${{ secrets.GH_PAT }}
+
+    - name: description
+      if: ${{ github.actor != 'dependabot' && github.actor != 'dependabot[bot]' }}
+      uses: gsactions/commit-message-checker@v2
+      with:
+        pattern: '^\S+( \S+)*$'
+        error: 'The PR description must not be empty.'
+        flags: 'gm'
+        excludeDescription: 'false'
+        excludeTitle: 'true'
+        checkAllCommitMessages: 'false'
+        accessToken: ${{ secrets.GH_PAT }}
diff --git a/.github/workflows/release-stable.yaml b/.github/workflows/release-stable.yaml
new file mode 100644
index 0000000..b4f2226
--- /dev/null
+++ b/.github/workflows/release-stable.yaml
@@ -0,0 +1,31 @@
+name: release-stable
+
+on:
+  push:
+    branches: [prod-staging]
+
+permissions:
+  deployments: write
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: prod-stable
+
+    - name: Reset promotion branch
+      run: |
+        git fetch origin prod-staging:prod-staging
+        git reset --hard prod-staging
+
+    - name: Create pull request
+      uses: peter-evans/create-pull-request@v6
+      with:
+        token: ${{ secrets.GH_PAT }}
+        base: prod-stable
+        title: "release: Merge latest prod-staging changes to prod-stable"
+        branch: prod-staging
diff --git a/.github/workflows/sync.yaml b/.github/workflows/sync.yaml
new file mode 100644
index 0000000..60b5199
--- /dev/null
+++ b/.github/workflows/sync.yaml
@@ -0,0 +1,58 @@
+name: sync
+
+on:
+  workflow_dispatch:
+    inputs:
+      channel:
+        default: prod-stable
+        description: |
+          The name of the release channel.
+          One of: [prod-stable, prod-staging]
+
+# Automatically cancel in-progress actions on the same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.channel }}
+
+    - name: Generate
+      shell: bash
+      env:
+        CHANNEL: ${{ inputs.channel }}
+      run: |
+        make generate
+        make fmt
+
+    - name: Show diff
+      shell: bash
+      run: |
+        git diff
+
+    - name: Generate branch ID
+      id: id
+      run: |
+        BRANCH="sync/$(date +'%Y%m%d%H%M%S')"
+        echo "name=${BRANCH}" >>"${GITHUB_OUTPUT}"
+
+    - name: Create pull request
+      uses: peter-evans/create-pull-request@v6
+      with:
+        token: ${{ secrets.GH_PAT }}
+        base: ${{ inputs.channel }}
+        commit-message: "sync: Update Python SDK from OpenAPI spec"
+        title: "sync: Update Python SDK from OpenAPI spec"
+        branch: ${{ steps.id.outputs.name }}
+        committer: Unikraft Bot <monkey@unikraft.io>
+        author: Unikraft Bot <monkey@unikraft.io>
+        add-paths: controlplane,platform
+        signoff: true