I'm a fan of post-facto confirmation. Allow CI/CD to do the upload automatically, and then have a web flow that confirms the release. Release doesn't go out unless the button is pressed.

It removes _most_ of the release friction while still adding the "human has acknowledged the release" bit.

▲

eviks 4 days ago | parent [-]

Maybe even send a user an email notification with a link...

	▲	rtpg 3 days ago \| parent [-]
		lol granted! But notice how in that universe since npm has to send the link, then access to the link is coupled to access to the email address, serving as an auth factor. In the attack described above, the attacker did not have access to the victim's email address.