diff --git a/.github/workflows/bank_feeds_generate.yaml b/.github/workflows/bank_feeds_generate.yaml
index d6e221d18..2fd103af1 100644
--- a/.github/workflows/bank_feeds_generate.yaml
+++ b/.github/workflows/bank_feeds_generate.yaml
@@ -1,3 +1,7 @@
+# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand.
+# Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK
+# Codegen generates this SDK and opens a versioned PR here, dispatched by the
+# oas pipeline. This stub only says so.
 name: Generate Bank Feeds library
 'on':
   workflow_dispatch:
@@ -11,15 +15,12 @@ name: Generate Bank Feeds library
         type: string
 jobs:
   generate:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15
-    with:
-      mode: pr
-      speakeasy_version: latest
-      force: ${{ github.event.inputs.force }}
-      set_version: ${{ github.event.inputs.set_version }}
-      target: bank-feeds-library
-    secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
-      slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generation moved to Codat SDK Codegen
+        run: |
+          echo "::warning::This workflow no longer generates anything. bank-feeds is generated by generate-and-pr.yml in Codat SDK Codegen, dispatched by the oas pipeline, which opens a versioned PR on this repo."
+          # Exits 0 because the oas pipeline still runs this workflow on every OAS
+          # merge; flip to exit 1 in the same change that switches the oas trigger
+          # to the repository dispatch, so stray runs become loud.
+          exit 0
diff --git a/.github/workflows/bank_feeds_release.yaml b/.github/workflows/bank_feeds_release.yaml
index af107b330..929087522 100644
--- a/.github/workflows/bank_feeds_release.yaml
+++ b/.github/workflows/bank_feeds_release.yaml
@@ -1,3 +1,9 @@
+# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand.
+# Publishing no longer runs in this repo. The packaging checks, the PyPI upload,
+# the tag and the GitHub release all run centrally in publish-python.yml in
+# Codat SDK Codegen - no check has been dropped, they just moved. This stub
+# only forwards the release trigger there, authenticated with a short-lived
+# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets.
 name: Release Bank Feeds library
 'on':
   push:
@@ -5,11 +11,34 @@ name: Release Bank Feeds library
     - bank-feeds/RELEASES.md
     branches:
     - main
+  workflow_dispatch: {}
+concurrency: publish-bank-feeds-python
 jobs:
   publish:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15
-    secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
-      slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check the App secrets are set
+        env:
+          APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }}
+          APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }}
+        run: |
+          if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then
+            echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen"
+            exit 1
+          fi
+      - name: Mint a token from the GitHub App
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }}
+          owner: codat-internal
+          repositories: sdk-codegen
+      - name: Hand the release to the central publish pipeline
+        run: |
+          curl --fail-with-body --silent --show-error -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \
+            https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \
+            -d '{"event_type": "publish-python", "client_payload": {"product": "bank-feeds", "sha": "${{ github.sha }}", "sdk_repo": "${{ github.repository }}"}}'
+          echo "publish-python dispatch sent to codat-internal/sdk-codegen for bank-feeds @ ${{ github.sha }}"
diff --git a/.github/workflows/lending_generate.yaml b/.github/workflows/lending_generate.yaml
index 87ded0070..93bcaab3b 100644
--- a/.github/workflows/lending_generate.yaml
+++ b/.github/workflows/lending_generate.yaml
@@ -1,3 +1,7 @@
+# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand.
+# Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK
+# Codegen generates this SDK and opens a versioned PR here, dispatched by the
+# oas pipeline. This stub only says so.
 name: Generate Lending library
 'on':
   workflow_dispatch:
@@ -11,15 +15,12 @@ name: Generate Lending library
         type: string
 jobs:
   generate:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15
-    with:
-      mode: pr
-      speakeasy_version: latest
-      force: ${{ github.event.inputs.force }}
-      set_version: ${{ github.event.inputs.set_version }}
-      target: lending-library
-    secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
-      slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
\ No newline at end of file
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generation moved to Codat SDK Codegen
+        run: |
+          echo "::warning::This workflow no longer generates anything. lending is generated by generate-and-pr.yml in Codat SDK Codegen, dispatched by the oas pipeline, which opens a versioned PR on this repo."
+          # Exits 0 because the oas pipeline still runs this workflow on every OAS
+          # merge; flip to exit 1 in the same change that switches the oas trigger
+          # to the repository dispatch, so stray runs become loud.
+          exit 0
diff --git a/.github/workflows/lending_release.yaml b/.github/workflows/lending_release.yaml
index 85ab3d43c..975c71154 100644
--- a/.github/workflows/lending_release.yaml
+++ b/.github/workflows/lending_release.yaml
@@ -1,3 +1,9 @@
+# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand.
+# Publishing no longer runs in this repo. The packaging checks, the PyPI upload,
+# the tag and the GitHub release all run centrally in publish-python.yml in
+# Codat SDK Codegen - no check has been dropped, they just moved. This stub
+# only forwards the release trigger there, authenticated with a short-lived
+# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets.
 name: Release Lending library
 'on':
   push:
@@ -5,11 +11,34 @@ name: Release Lending library
     - lending/RELEASES.md
     branches:
     - main
+  workflow_dispatch: {}
+concurrency: publish-lending-python
 jobs:
   publish:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15
-    secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
-      slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check the App secrets are set
+        env:
+          APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }}
+          APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }}
+        run: |
+          if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then
+            echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen"
+            exit 1
+          fi
+      - name: Mint a token from the GitHub App
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }}
+          owner: codat-internal
+          repositories: sdk-codegen
+      - name: Hand the release to the central publish pipeline
+        run: |
+          curl --fail-with-body --silent --show-error -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \
+            https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \
+            -d '{"event_type": "publish-python", "client_payload": {"product": "lending", "sha": "${{ github.sha }}", "sdk_repo": "${{ github.repository }}"}}'
+          echo "publish-python dispatch sent to codat-internal/sdk-codegen for lending @ ${{ github.sha }}"
diff --git a/.github/workflows/platform_generate.yaml b/.github/workflows/platform_generate.yaml
index 969f1e2f0..a0dc2273e 100644
--- a/.github/workflows/platform_generate.yaml
+++ b/.github/workflows/platform_generate.yaml
@@ -1,3 +1,7 @@
+# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand.
+# Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK
+# Codegen generates this SDK and opens a versioned PR here, dispatched by the
+# oas pipeline. This stub only says so.
 name: Generate Platform library
 'on':
   workflow_dispatch:
@@ -11,15 +15,12 @@ name: Generate Platform library
         type: string
 jobs:
   generate:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15
-    with:
-      mode: pr
-      speakeasy_version: latest
-      force: ${{ github.event.inputs.force }}
-      set_version: ${{ github.event.inputs.set_version }}
-      target: platform-library
-    secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
-      slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generation moved to Codat SDK Codegen
+        run: |
+          echo "::warning::This workflow no longer generates anything. platform is generated by generate-and-pr.yml in Codat SDK Codegen, dispatched by the oas pipeline, which opens a versioned PR on this repo."
+          # Exits 0 because the oas pipeline still runs this workflow on every OAS
+          # merge; flip to exit 1 in the same change that switches the oas trigger
+          # to the repository dispatch, so stray runs become loud.
+          exit 0
diff --git a/.github/workflows/platform_release.yaml b/.github/workflows/platform_release.yaml
index 348fb5c19..b304d8da4 100644
--- a/.github/workflows/platform_release.yaml
+++ b/.github/workflows/platform_release.yaml
@@ -1,3 +1,9 @@
+# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand.
+# Publishing no longer runs in this repo. The packaging checks, the PyPI upload,
+# the tag and the GitHub release all run centrally in publish-python.yml in
+# Codat SDK Codegen - no check has been dropped, they just moved. This stub
+# only forwards the release trigger there, authenticated with a short-lived
+# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets.
 name: Release Platform library
 'on':
   push:
@@ -5,11 +11,34 @@ name: Release Platform library
     - platform/RELEASES.md
     branches:
     - main
+  workflow_dispatch: {}
+concurrency: publish-platform-python
 jobs:
   publish:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15
-    secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
-      slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check the App secrets are set
+        env:
+          APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }}
+          APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }}
+        run: |
+          if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then
+            echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen"
+            exit 1
+          fi
+      - name: Mint a token from the GitHub App
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }}
+          owner: codat-internal
+          repositories: sdk-codegen
+      - name: Hand the release to the central publish pipeline
+        run: |
+          curl --fail-with-body --silent --show-error -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \
+            https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \
+            -d '{"event_type": "publish-python", "client_payload": {"product": "platform", "sha": "${{ github.sha }}", "sdk_repo": "${{ github.repository }}"}}'
+          echo "publish-python dispatch sent to codat-internal/sdk-codegen for platform @ ${{ github.sha }}"
diff --git a/.github/workflows/sync_for_expenses_generate.yaml b/.github/workflows/sync_for_expenses_generate.yaml
index 39ea556f9..fafe61375 100644
--- a/.github/workflows/sync_for_expenses_generate.yaml
+++ b/.github/workflows/sync_for_expenses_generate.yaml
@@ -1,3 +1,7 @@
+# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand.
+# Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK
+# Codegen generates this SDK and opens a versioned PR here, dispatched by the
+# oas pipeline. This stub only says so.
 name: Generate Sync for Expenses library
 'on':
   workflow_dispatch:
@@ -11,15 +15,12 @@ name: Generate Sync for Expenses library
         type: string
 jobs:
   generate:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15
-    with:
-      mode: pr
-      speakeasy_version: latest
-      force: ${{ github.event.inputs.force }}
-      set_version: ${{ github.event.inputs.set_version }}
-      target: sync-for-expenses-library
-    secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
-      slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generation moved to Codat SDK Codegen
+        run: |
+          echo "::warning::This workflow no longer generates anything. sync-for-expenses is generated by generate-and-pr.yml in Codat SDK Codegen, dispatched by the oas pipeline, which opens a versioned PR on this repo."
+          # Exits 0 because the oas pipeline still runs this workflow on every OAS
+          # merge; flip to exit 1 in the same change that switches the oas trigger
+          # to the repository dispatch, so stray runs become loud.
+          exit 0
diff --git a/.github/workflows/sync_for_expenses_release.yaml b/.github/workflows/sync_for_expenses_release.yaml
index 47f008208..ed9320c13 100644
--- a/.github/workflows/sync_for_expenses_release.yaml
+++ b/.github/workflows/sync_for_expenses_release.yaml
@@ -1,3 +1,9 @@
+# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand.
+# Publishing no longer runs in this repo. The packaging checks, the PyPI upload,
+# the tag and the GitHub release all run centrally in publish-python.yml in
+# Codat SDK Codegen - no check has been dropped, they just moved. This stub
+# only forwards the release trigger there, authenticated with a short-lived
+# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets.
 name: Release Sync for Expenses library
 'on':
   push:
@@ -5,11 +11,34 @@ name: Release Sync for Expenses library
     - sync-for-expenses/RELEASES.md
     branches:
     - main
+  workflow_dispatch: {}
+concurrency: publish-sync-for-expenses-python
 jobs:
   publish:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15
-    secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
-      slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check the App secrets are set
+        env:
+          APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }}
+          APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }}
+        run: |
+          if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then
+            echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen"
+            exit 1
+          fi
+      - name: Mint a token from the GitHub App
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }}
+          owner: codat-internal
+          repositories: sdk-codegen
+      - name: Hand the release to the central publish pipeline
+        run: |
+          curl --fail-with-body --silent --show-error -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \
+            https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \
+            -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-expenses", "sha": "${{ github.sha }}", "sdk_repo": "${{ github.repository }}"}}'
+          echo "publish-python dispatch sent to codat-internal/sdk-codegen for sync-for-expenses @ ${{ github.sha }}"
diff --git a/.github/workflows/sync_for_payables_generate.yaml b/.github/workflows/sync_for_payables_generate.yaml
index 81a3e48e0..fb56617ce 100644
--- a/.github/workflows/sync_for_payables_generate.yaml
+++ b/.github/workflows/sync_for_payables_generate.yaml
@@ -1,3 +1,7 @@
+# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand.
+# Generation no longer runs in this repo: generate-and-pr.yml in Codat SDK
+# Codegen generates this SDK and opens a versioned PR here, dispatched by the
+# oas pipeline. This stub only says so.
 name: Generate Sync for Payables library
 'on':
   workflow_dispatch:
@@ -11,15 +15,12 @@ name: Generate Sync for Payables library
         type: string
 jobs:
   generate:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15
-    with:
-      mode: pr
-      speakeasy_version: latest
-      force: ${{ github.event.inputs.force }}
-      set_version: ${{ github.event.inputs.set_version }}
-      target: sync-for-payables-library
-    secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
-      slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generation moved to Codat SDK Codegen
+        run: |
+          echo "::warning::This workflow no longer generates anything. sync-for-payables is generated by generate-and-pr.yml in Codat SDK Codegen, dispatched by the oas pipeline, which opens a versioned PR on this repo."
+          # Exits 0 because the oas pipeline still runs this workflow on every OAS
+          # merge; flip to exit 1 in the same change that switches the oas trigger
+          # to the repository dispatch, so stray runs become loud.
+          exit 0
diff --git a/.github/workflows/sync_for_payables_release.yaml b/.github/workflows/sync_for_payables_release.yaml
index 66e306b02..4e23fb4b2 100644
--- a/.github/workflows/sync_for_payables_release.yaml
+++ b/.github/workflows/sync_for_payables_release.yaml
@@ -1,3 +1,9 @@
+# Written by sdk-codegen (emit_workflow_stubs.py); do not edit by hand.
+# Publishing no longer runs in this repo. The packaging checks, the PyPI upload,
+# the tag and the GitHub release all run centrally in publish-python.yml in
+# Codat SDK Codegen - no check has been dropped, they just moved. This stub
+# only forwards the release trigger there, authenticated with a short-lived
+# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets.
 name: Release Sync for Payables library
 'on':
   push:
@@ -5,11 +11,34 @@ name: Release Sync for Payables library
     - sync-for-payables/RELEASES.md
     branches:
     - main
+  workflow_dispatch: {}
+concurrency: publish-sync-for-payables-python
 jobs:
   publish:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15
-    secrets:
-      github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
-      slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check the App secrets are set
+        env:
+          APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }}
+          APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }}
+        run: |
+          if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then
+            echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen"
+            exit 1
+          fi
+      - name: Mint a token from the GitHub App
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }}
+          owner: codat-internal
+          repositories: sdk-codegen
+      - name: Hand the release to the central publish pipeline
+        run: |
+          curl --fail-with-body --silent --show-error -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \
+            https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \
+            -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-payables", "sha": "${{ github.sha }}", "sdk_repo": "${{ github.repository }}"}}'
+          echo "publish-python dispatch sent to codat-internal/sdk-codegen for sync-for-payables @ ${{ github.sha }}"