Immutable Tags / Releases

[tim-hanssen]

Hi all!

Recent incidents like with Trivy scanner last friday showed that retagging versions can create security risks.

A version like v3.4.2 should always point to the same commit.

Proposal:

• Enable tag protection for all releases
• Disallow force-push and deletion of version tags

Why:

• Prevents supply chain risks
• Ensures reproducible builds

[frankdejonge]

I've enabled tag immutability.