add missing approval doc (#244)

README.md

@@ -62,7 +62,7 @@ yarn test
 
 ### Automatic
 
-The normal flow for publishing a release is through a series o GitHub actions that are triggered when a PR is closed by merging with the base branch. Full details about our workflows can be found in [./.github/WORKFLOW-README.MD]. A summary of our publish workflow follows:
+The normal flow for publishing a release is through a series o GitHub actions that are triggered when a PR is closed by merging with the base branch. Full details about our workflows can be found in [docs](./docs/github_workflows.md). A summary of our publish workflow follows:
 
 1. Close a PR containing your changes
 2. If the PR was merged and if it contains a version label instruction (patch, minor, major, none), a new PR will be created that contains the result of running `npm version LABEL` on main with the original PR author assigned as a reviewer.

docs/github_workflows.md

@@ -106,7 +106,7 @@ This job is responsible for creating a new pull request with a version bump comm
 
 ### [publish](../.github/workflows/publish.yaml)
 
-The publish workflow is used to publish an NPM package when changes (version-bump pull requests) are pushed to the main branch and the package.json file is updated.
+The publish workflow is used to publish an NPM package when changes (version-bump pull requests) are pushed to the main branch and the package.json file is updated. **Requires an engineer to approve the use of production credentials.**
 The workflow ensures that the current package version is different from the previously published version before initiating the publishing process.
 
 #### Trigger Events