package deployment command and provenance with gh actions.

I was thinking about creating some libs using the [Haxe](https://haxe.org/) language, as I can transpile it to Lua, JS, PHP... etc., reusing all the logic and making some small adjustments.

In NPM there is no problem with this because you have the `npm publish` command and you can send your package after a specific build as a minification or pre-compiled code.

But in composer packagist, package deployment is associated with the source code, well the source code would just be hash and some js and php decorations.

I think it might be interesting to have a way like NPM to publish a pre-build package, currently they have a system that checks whether the CD pipeline was actually published, it's something interesting if the concern is security against malware.

No files, tests, or entry points are named. First clarify the supported package deployment and provenance workflow, its security requirements, and how GitHub Actions would be verified; done should be a documented, agreed implementation scope with acceptance criteria.

Written by the indexing model from the issue text.