diff --git a/.github/labeler.yml b/.github/labeler.yml
new file mode 100644
index 0000000..b33fb4f
--- /dev/null
+++ b/.github/labeler.yml
@@ -0,0 +1,14 @@
+tests:
+  - tests/**/*
+
+core:
+  - xoto3/**/*
+
+dependencies:
+  - Pipfile*
+
+internal:
+  - ./CHANGES.md
+
+documentation:
+  - ./README.md
diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml
new file mode 100644
index 0000000..7e0fb7c
--- /dev/null
+++ b/.github/release-drafter.yml
@@ -0,0 +1,31 @@
+change-template: "* $TITLE (#$NUMBER) by @$AUTHOR"
+categories:
+  - title: "⚡ Breaking Changes"
+    labels:
+      - "breaking-change"
+  - title: "🌟New features and non-breaking changes"
+    labels:
+      - "major"
+      - "feature"
+  - title: "🌟 Minor Changes"
+    labels:
+      - "enhancement"
+  - title: "📜 Documentation updates"
+    labels:
+      - "documentation"
+  - title: "🐛 Bug and hot fixes"
+    labels:
+      - "bug"
+      - "fix"
+  - title: "🚒 Deprecations"
+    labels:
+      - "deprecated"
+exclude-labels:
+  - "skip-changelog"
+tag-template: "v$NEXT_PATCH_VERSION"
+template: |
+  ## Changes
+  **[Human readable summary of changes]**
+  $CHANGES
+  ## This release was made possible by the following contributors:
+  $CONTRIBUTORS
diff --git a/.github/semantic.yml b/.github/semantic.yml
new file mode 100644
index 0000000..9b85ad3
--- /dev/null
+++ b/.github/semantic.yml
@@ -0,0 +1,15 @@
+types:
+  - feat
+  - fix
+  - docs
+  - style
+  - refactor
+  - perf
+  - test
+  - build
+  - ci
+  - chore
+  - revert
+  - improv
+
+titleOnly: true
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
new file mode 100644
index 0000000..d359cfe
--- /dev/null
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,29 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [develop]
+  pull_request:
+    branches: [develop]
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["python"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1
diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
new file mode 100644
index 0000000..db4ce91
--- /dev/null
+++ b/.github/workflows/pr-labeler.yml
@@ -0,0 +1,11 @@
+name: "PR Labeler"
+on:
+  - pull_request_target
+
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@main
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..4c67686
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,58 @@
+name: Publish
+
+# RELEASE PROCESS
+#
+# === Manual ===
+#
+# 1. Document human readable changes in CHANGES
+# 2. Bump package version
+# 3. Create a PR to develop branch
+# 4. Edit the current draft release notes
+# 5. If not already set, use `v<new version>` as a tag, and select develop as target branch
+#
+# === Automated ===
+#
+# 1. Extract release notes name that was published
+# 2. Ensure release notes name match what's in CHANGES
+# 5. Publish package to PyPi
+# 6. Push latest release source code to master using release title as the commit message
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  upload:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python 3.7
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.7"
+      - name: Set release notes name
+        run: |
+          export RELEASE_NAME_VERSION=${{ github.event.release.name }}
+          echo "RELEASE_NAME_VERSION=${RELEASE_NAME_VERSION}" >> $GITHUB_ENV
+      - name: Ensure new version is also set in CHANGES.md
+        run: |
+          grep --regexp "${RELEASE_NAME_VERSION}" CHANGES.md
+      - name: Setup & Build
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install pipenv
+          export PATH=/home/runner/.local/bin:$PATH
+          pipenv install --dev --skip-lock
+          python setup.py sdist
+      - name: pypi-publish
+        uses: pypa/gh-action-pypi-publish@v1.4.2
+        with:
+          user: xoi-technologies
+          password: ${{ secrets.PYPI_API_TOKEN }}
+  sync_main:
+    needs: upload
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Sync main from detached head
+        run: git push origin HEAD:refs/heads/main --force
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
new file mode 100644
index 0000000..ba09160
--- /dev/null
+++ b/.github/workflows/release-drafter.yml
@@ -0,0 +1,14 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - develop
+
+jobs:
+  update_release_draft:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: release-drafter/release-drafter@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..a8aa084
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,28 @@
+# Contributing
+
+Please be nice.
+
+### Issues
+
+Please open bugs using GitHub. Please provide a `pytest` style unit
+test that reproduces the issue if at all possible.
+
+### PRs
+
+Please feel free to fork and make PRs from your fork.
+
+### Code style
+
+We use `pytest` for running tests and aim for 100% code coverage since
+this is a pure library.
+
+All code must have appropriate static type annotations that work with
+`mypy`.
+
+Please `pre-commit install` before making any commits. Our style
+guidelines will be enforced by those [hooks](https://pre-commit.com/).
+
+### Suggestions and comments
+
+We're interested to hear what you think and what you'd do
+differently. You can open a GitHub issue for general feedback as well.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..638f99c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please email `security@xoi.io` with any concerns about security.
+
+## Supported Versions
+
+We do not provide any guarantees, security or otherwise, for this project, as per the license agreement.
+
+If security issues arise, we will update this document with information about which versions have been patched.
diff --git a/dev-utils/watch-cloudwatch-log-stream.py b/dev-utils/watch-cloudwatch-log-stream.py
new file mode 100644
index 0000000..7f87b07
--- /dev/null
+++ b/dev-utils/watch-cloudwatch-log-stream.py
@@ -0,0 +1,33 @@
+from datetime import datetime, timedelta
+from functools import partial
+
+import boto3
+
+from xoto3.paginate import yield_pages_from_operation
+
+cw_client = boto3.client("logs")
+
+start_time = (datetime.utcnow() - timedelta(hours=20)).timestamp() * 1000
+end_time = datetime.utcnow().timestamp() * 1000
+
+query = dict(
+    logGroupName="xoi-ecs-logs-devl",
+    logStreamNamePrefix="dataplateocr/dataplateocrContainer",
+    startTime=int(start_time),
+    endTime=int(end_time),
+)
+
+nt = ("nextToken",)
+CLOUDWATCH_FILTER_LOG_EVENTS = (
+    nt,
+    nt,
+    ("limit",),
+    ("events",),
+)
+
+yield_cloudwatch_pages = partial(yield_pages_from_operation, *CLOUDWATCH_FILTER_LOG_EVENTS,)
+
+
+for page in yield_cloudwatch_pages(cw_client.filter_log_events, query,):
+    for event in page["events"]:
+        print(event["message"])