Since Oct 2025 GitHub supports so called "Immutable Releases", docs. This feature makes the associated Git tag immutable and protects the release assets. It even protects against "repository resurrection attacks" .
Enabling immutable releases on ASF project repositories seems to be a nice addition.
The PyGithub library (newest version 2.8.1, supported APIs) however does not know about this feature yet. There is an open issue and a draft PR though. OTOH, the endpoints to check the status, enable or disable are not complex, so using the Repository.requester() directly does not seem complicated.
Wonder if it could be made available via .asf.yaml via a new github feature in the configuration like this
github:
immutable_releases: true|false
and an implementation in asfyaml/feature/github which evaluates the new configuration, where immutable releases are enabled, if immutable_releases == true and disabled if the config is not present or false.
Since Oct 2025 GitHub supports so called "Immutable Releases", docs. This feature makes the associated Git tag immutable and protects the release assets. It even protects against "repository resurrection attacks" .
Enabling immutable releases on ASF project repositories seems to be a nice addition.
The PyGithub library (newest version 2.8.1, supported APIs) however does not know about this feature yet. There is an open issue and a draft PR though. OTOH, the endpoints to check the status, enable or disable are not complex, so using the
Repository.requester()directly does not seem complicated.Wonder if it could be made available via
.asf.yamlvia a new github feature in the configuration like thisand an implementation in
asfyaml/feature/githubwhich evaluates the new configuration, where immutable releases are enabled, ifimmutable_releases == trueand disabled if the config is not present orfalse.