diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d41da535..8a2e89b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,7 @@ name: CI
 on:
   push:
     branches: [ master ]
+    tags: [ "**" ]
   pull_request:
     branches: [ master ]
 
@@ -53,7 +54,8 @@ jobs:
   test:
     name: ${{ matrix.task.name}} - ${{ matrix.os.name }} ${{ matrix.python.name }}
     runs-on: ${{ matrix.os.runs-on }}
-    needs: build
+    needs:
+      - build
     strategy:
       fail-fast: false
       matrix:
@@ -125,6 +127,8 @@ jobs:
   check:
     name: ${{ matrix.task.name}} - ${{ matrix.python.name }}
     runs-on: ubuntu-latest
+    needs:
+      - build
     strategy:
       fail-fast: false
       matrix:
@@ -137,8 +141,6 @@ jobs:
         task:
           - name: Flake8
             tox: flake8
-          - name: Check Manifest
-            tox: check-manifest
           - name: Check Newsfragment
             tox: check-newsfragment
 
@@ -147,6 +149,12 @@ jobs:
       with:
         fetch-depth: 0
 
+    - name: Download package files
+      uses: actions/download-artifact@v2
+      with:
+        name: dist
+        path: dist/
+
     - name: Set up ${{ matrix.python.name }}
       uses: actions/setup-python@v2
       with:
@@ -160,6 +168,48 @@ jobs:
     - name: Tox
       run: tox -c tox.ini -e ${{ matrix.task.tox }}
 
+  pypi-publish:
+    # https://github.community/t/is-it-possible-to-require-all-github-actions-tasks-to-pass-without-enumerating-them/117957/4?u=graingert
+    name: Check tag and publish
+    runs-on: ubuntu-latest
+
+    needs:
+      - build
+      - test
+      - check
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Download package files
+      uses: actions/download-artifact@v2
+      with:
+        name: dist
+        path: dist/
+
+    - name: Set up Python
+      uses: actions/setup-python@v2
+      with:
+        python-version: 3.8
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip setuptools wheel
+        python -m pip install pep517
+
+    - name: Display structure of files to be pushed
+      run: ls --recursive dist/
+
+    - name: Check matched tag version and branch version - on tag
+      if: startsWith(github.ref, 'refs/tags/')
+      run: python admin/check_tag_version_match.py "${{ github.ref }}"
+
+    - name: Publish to PyPI - on tag
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: pypa/gh-action-pypi-publish@v1.4.2
+      with:
+        password: ${{ secrets.PYPI_TOKEN }}
+        verbose: true
+
   all:
     name: All
     runs-on: ubuntu-latest
@@ -167,6 +217,7 @@ jobs:
       - build
       - test
       - check
+      - pypi-publish
     steps:
       - name: This
         shell: python
diff --git a/MANIFEST.in b/MANIFEST.in
index 2098ab18..b44c1ea7 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -5,6 +5,7 @@ include CODE_OF_CONDUCT.md
 include pyproject.toml
 include tox.ini
 include tox_build.sh
+include tox_check-release.sh
 recursive-include src *.rst
 
 exclude bin
diff --git a/admin/check_tag_version_match.py b/admin/check_tag_version_match.py
new file mode 100644
index 00000000..a4596565
--- /dev/null
+++ b/admin/check_tag_version_match.py
@@ -0,0 +1,34 @@
+#
+# Used during the release process to make sure that we release based on a
+# tag that has the same version as the current twisted.__version.
+#
+# Designed to be conditionally called inside GitHub Actions release job.
+# Tags should use PEP440 version scheme.
+#
+# To be called as: admin/check_tag_version_match.py refs/tags/twisted-20.3.0
+#
+import sys
+
+import pep517.meta
+
+TAG_PREFIX = "refs/tags/"
+
+if len(sys.argv) < 2:
+    print("No tag check requested.")
+    sys.exit(0)
+
+branch_version = pep517.meta.load(".").version
+run_version = sys.argv[1]
+
+if not run_version.startswith(TAG_PREFIX):
+    print("Not a twisted release tag name '{}.".format(run_version))
+    sys.exit(1)
+
+run_version = run_version[len(TAG_PREFIX) :]
+
+if run_version != branch_version:
+    print("Branch is at '{}' while tag is '{}'".format(branch_version, run_version))
+    exit(1)
+
+print("All good. Branch and tag versions match for '{}'.".format(branch_version))
+sys.exit(0)
diff --git a/src/towncrier/_version.py b/src/towncrier/_version.py
index df10872d..155142ce 100644
--- a/src/towncrier/_version.py
+++ b/src/towncrier/_version.py
@@ -7,5 +7,5 @@
 
 from incremental import Version
 
-__version__ = Version("towncrier", 19, 2, 0)
+__version__ = Version("towncrier", 21, 3, 0, dev=4)
 __all__ = ["__version__"]
diff --git a/src/towncrier/newsfragments/315.misc.rst b/src/towncrier/newsfragments/315.misc.rst
new file mode 100644
index 00000000..e69de29b
diff --git a/tox.ini b/tox.ini
index 4ea7078c..073a8a45 100644
--- a/tox.ini
+++ b/tox.ini
@@ -10,13 +10,6 @@ deps =
 commands =
    flake8 src/towncrier/
 
-[testenv:check-manifest]
-skip_install = True
-deps =
-   check_manifest
-commands =
-   check-manifest -v
-
 [testenv:check-newsfragment]
 commands =
    python -m towncrier.check
@@ -44,6 +37,8 @@ allowlist_externals =
 changedir = {envtmpdir}
 deps =
    build
+   check-manifest>=0.44
+   twine
 setenv =
    toxinidir={toxinidir}
 skip_install = true
diff --git a/tox_build.sh b/tox_build.sh
index 875aa9ae..c43685f3 100644
--- a/tox_build.sh
+++ b/tox_build.sh
@@ -1,6 +1,16 @@
 # build the sdist
+
+set -evx
+
+check-manifest --verbose ${toxinidir}
+
 python -m build --sdist --outdir ${toxinidir}/dist/ ${toxinidir}
+
 tar -xvf ${toxinidir}/dist/*
 cd *
+
 # build the wheel from the sdist
 python -m build --wheel --outdir ${toxinidir}/dist/ .
+cd -
+
+twine check ${toxinidir}/dist/*