Post

Do you want to try out drydock.org? It will show you the diff of the staged package and send you an email when it's done all threat controls

Can I use it in a publish workflow from my local machine?

No, it automatically picks up either GitHub gated workflow environments or tarballs that are staged