Support Immutable Releases

[EelcoLos]

Describe

As immutable releases are now generally available (https://github.blog/changelog/2025-10-28-immutable-releases-are-now-generally-available/) can you enable this on the repository?

Proposed solution

enable the setting on the repository. according to github, this should be the only thing you should set

Alternatives considered

don't enable this

[jozefizso]

Hi @EelcoLos, thanks for this suggestion.

I am not sure how immutable releases would work with the tag which must be changed with each release (eg. v2 tag).

I would also wait how this will be implemented in the actions/* repositories, eg. actions/checkout#2316

Immutable releases must be enabled by a repo admin, in this case @dorny.

[LMSSonos]

@jozefizso, @dorny - first of all, many thanks for your action and the time you put into this

As supply chain attacks get more common day by day, I think it would be a huge advantage to have immutable releases. Just as you can read here, aquasecurity/trivy-action#541 the risk is present.

PS: I was also surprised to see, that all gh actions/* don't have that enabled.

[jozefizso]

1. You can always use git commit to identify a unique release of the code
2. Actions must move general tags (like @v1) to the latest release in that major version train. As such tags reference different commits over the action lifetime, immutability is not enforced
3. I am not sure if only selected tags can be immutable.

[jozefizso]

Based on the Trivy compromise, we will need to update our workflows to explicitly define lower permissions for them.