- publishing with an API token is forbidden, must use the specified workflow w/ OIDC auth
- an explicit approval step in GitHub is required to run the publish workflow (you can also set a time delay, similar to time release safes)
- provenance is generated and published
toonewbie•39m ago