Notes for review.

Additionally, and for future reference, the QA testing for this will be performed in two rounds:

• While the PR is still a draft, QA will first use the commit SHA to reference the updates in the main.yml file. They’ll also update the secrets etc as required, and run the workflow to see if the post-update behavior is fine. At this point, dev needs to work with QA to run or stop the GitHub Action runner as and when required, update secrets and other configuration info.
• If fine, then mark the PR as ready for review. If code review goes fine, merge the PR, and this will publish the new bumped version of the package.json. At this point, QA can use the new version tag in the main.yml file instead of the commit hash, and smoke test to make sure everything works fine again.