Devs on my team have been publishing their locally-made builds to github. I want to prevent them from being able to do this. I did a bit of research, and got to thinking perhaps I need to prevent them from having the packages:write scope, shown here:

But I’m not sure how to go about doing that. Note that I do want folks to be able to run Github actions, some of which create builds and publish packages. But I don’t want them to be able to publish packages outside of running an Action.