Feature request: Different levels for Maven Central tokens (deploy and publish)

Central Repository
1

Hi,

I keep tokens in GitHub secrets to publish to Maven Central. I am worried because these tokens can do everything. I recently have seen a supply chain take over just because of bad configured GH pipelines that stealed GH secrets.

Right now one token can publish directly. Once something is published, we cannot delete it.

It would be good to have two types of tokens:

  • One for deploy (only upload to staging)

  • One for publish (to make it public)

This way even if a CI token is stolen, it cannot publish directly.

Is this something you can add?

Thanks!