Release automation per Fastify org about releasify

[mcollina]

I think the token should require OTP to publish, or maybe I misunderstood the docs.

[mcollina]

Will the OTP expires during the workflow?

Unlikely, worst case you can try again. It'd be good to use an "early" OTP.. one that was newly generated.

Who is authorized to run the action?

I think anybody that has commit access to master. This would be ok for plugins, less so for fastify. However most of the tedius work is plugins.. so I think that's ok.

[Eomm]

I was working on it but I didn't think that if I want to release with npm publish I must:

• login to npm, running npm login
• provide an NPM TOKEN (that doesn't require OTP) - via github secrets

So do we want to generate this dangerous token?