does our CI/CD email on releases to pmc? if not it might make sense to do so (as a protection around https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm )