Enable immutable releases

[ericcornelissen]

Description:
This action should enable immutable releases, just like actions/attest-build-provenance has.

Justification:
To help protect users against potential attacks such as GHSA-mrrh-fwg8-r2c3 by preventing re-pointing (released) tags to different commits.

Are you willing to submit a PR?
n/a

[aparnajyothi-y]

Hello @ericcornelissen, Thanks for creating this issue and we will get back to you once we have some feedback on this :)

[eternaltyro]

This will actually help with my clients' compliance processes as well. There are several actions that are indispensable and enabling immutable releases is very low effort with good rewards. Please action this as soon as you can.

[zi0Black]

+1 with people asking to enable this 🫶

[meroamir99881-hue]

Integrating mobile phone sensors when watching pornographic films, in addition to translating the content. في الأحد، ٥ نيسان ٢٠٢٦، ٤:٢١ م Andrea Cappa (zi0Black) < ***@***.***> كتب:

…

*zi0Black* left a comment (actions/setup-node#1504) <#1504 (comment)> +1 with people asking to enable this 🫶 — Reply to this email directly, view it on GitHub <#1504 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BZUP2XQNX2AHTLJYYG622ML4UJMWBAVCNFSM6AAAAACWH3I4USVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DCOBYHA4DGMZUGA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[Ay1tsMe]

Bumping.

Following the recent Trivy supply chain compromise, I believe this should be a high priority. It has been abundantly clear that this should occur on all GitHub actions as a defense-in-depth measure to prevent tampering with GitHub actions if a future supply chain compromise occurs. Can this be done?

Reference: Preventing changes to your releases

[priya-kinthali]

Hello everyone👋,
Thanks for raising this! We're happy to share that Immutable releases are now enabled for this action, starting with v7.0.0, to ensure published tags can't be moved to different commits. Since this request is now resolved, I'll go ahead and close the issue. Thanks again to everyone for the suggestion and the discussion!