I'd protect my GitHub account with 2FA and configure GitHub Actions to trigger on creating a release in GitHub. That way my release process is fully automated but still protected by 2FA, in this case GitHub's 2FA implementation.