Tags :latest and the commit SHA, authenticated with the built-in GITHUB_TOKEN via the packages:write permission. Making the package public is a one-time manual step in the package settings after the first push.