🚀 Immutable Releases Are Now Generally Available!

[tinaheidinger]

Immutable Releases are now generally available for all GitHub organizations and repositories!

This release brings a new layer of supply chain security to GitHub Releases by locking down release assets and tags after publication and generating signed attestations for every asset.

To get started, check out our changelog post and documentation.

We’d love for you to try Immutable Releases and share your feedback! Your input helps us polish the experience as we continue to invest in secure, reliable software distribution.

Let us know your questions, thoughts, and feedback in the discussion below. Thanks for helping us make GitHub Releases even more secure for everyone!

[maennchen]

This is a very welcome feature, but there’s a practical gap for projects that publish moving releases.

Many repositories (for example elixir-lang/elixir) publish immutable tagged releases alongside rolling ones, for example:

v<major>.<minor>-latest
main-latest

These intentionally update over time to track pre-release builds and nightly fixes.

Right now immutability is “all or nothing”, which breaks that workflow. What’s really needed is the ability to define an exclude pattern (similar to branch protection rules) so certain release name patterns remain mutable. Anything not excluded would be immutable by default, and previously published releases without an exclusion would stay immutable.

That would make the feature usable for projects that rely on both stable and rolling releases side-by-side.