package deployment command and provenance with gh actions.

[RodrigoDornelles]

I was thinking about creating some libs using the Haxe language, as I can transpile it to Lua, JS, PHP... etc., reusing all the logic and making some small adjustments.

In NPM there is no problem with this because you have the npm publish command and you can send your package after a specific build as a minification or pre-compiled code.

But in composer packagist, package deployment is associated with the source code, well the source code would just be hash and some js and php decorations.

I think it might be interesting to have a way like NPM to publish a pre-build package, currently they have a system that checks whether the CD pipeline was actually published, it's something interesting if the concern is security against malware.