feat(release): publish each tag as an immutable GitHub release - #12
Open
absorbb wants to merge 1 commit into
Open
feat(release): publish each tag as an immutable GitHub release#12absorbb wants to merge 1 commit into
absorbb wants to merge 1 commit into
Conversation
The repo now has immutable releases enabled; a bare tag is not protected, only tags attached to a published release. release.yml publishes one per tag so consumers pinning @<tag> get SHA-pin guarantees. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2 tasks
![jitsu-code-review[bot]](https://avatars.githubusercontent.com/in/3391383?s=60&v=4){kind=small}
There was a problem hiding this comment.
Reviewed the release workflow and the corresponding versioning documentation. The workflow creates the release tag at the triggering commit with the required contents permission, and existing repository releases confirm immutability is active. No actionable findings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #11 (merged before this commit could ride along).
PUT /repos/jitsucom/github-workflows/immutable-releases→enabled: true). A tag attached to a published release can't be moved or deleted while the release exists, and the name can never be reused — souses: …@1.32.20260826in consumers is as strong as a SHA pin.release.ymlnow creates the tag viagh release create --target "$GITHUB_SHA"instead of pushing a bare tag first: tag + release are created atomically, there is never a window with an unprotected tag on origin, and a failed run leaves nothing behind (rerun = clean retry).immutable: true:1.30.20260821,1.32.20260826,1.34.20260826. Older tags stay ordinary tags.Test plan
ai-review.ymluntouchedimmutable: true1.36.<date>(or similar) as a release,gh api repos/jitsucom/github-workflows/releases/tags/<tag>showsimmutable: true, and the tag can't be force-moved🤖 Generated with Claude Code