Release and respond
Protect publishing authority
Separate package and deployment credentials from development, use short-lived identity where available, and require protected release workflows.
8 minute lesson
Publishing credentials can replace trusted software for every consumer. Keep them out of developer laptops when the platform supports a safer path.
Prefer workload identity or trusted publishing from a protected workflow. Scope tokens to one project, restrict release environments, require review for high-impact publishing, and rotate long-lived credentials. Test revocation before an incident.
A long-lived registry token sits on a maintainer laptop and can publish every package in an organization. A stolen token lets an attacker replace trusted software without changing the repository.
Trusted publishing exchanges that reusable secret for a short-lived workflow identity. The workflow and release environment then become critical policy boundaries.
Draw the identities from release approval to registry publication and save the effective permissions at every step. Configure or simulate a short-lived publisher limited to one package and protected environment. Then attempt publication from an unapproved branch and prove the registry or workflow rejects it.
Lesson completed