What about adding a human in the loop? So the actual releases to the package registry would be done manually after reviewing the package?