We no longer publish to the public dockerhub, and we use an
internal CI server to push releases to pypi. This reduces
public/open visibility in this process. But it spares us from
having to distribute tokens to third parties.