ossf security best practice: To enable collaborative review, the project's source repository MUST include interim versions for review between releases; it MUST NOT include only final releases

[illume]

• change the release process to do release candidates / alpha releases.
• document it in the release process doc