Repository navigation
Immutable Releases #521
Description
Enabling this will make it easier to use this action in a secure way, with mutable tags I need to either fork this action or pin to a Git SHA to ensure that I am using a known version of this action, with an immutable release I can pin to the tag and be confident the code won't be maliciously modified due to a compromise of this repo.
It also makes it easier to understand what version we are using in workflows as we can view the version number instead of a sha
Activity
zimeg commentedon Jan 9, 2026
Hey @CalvinRodo! 👋 Thanks for sharing this update with us - it looks quite promising 🐙
At the moment our release process creates then moves the release tag on "publish" to a packaged commit to avoid clutter on the
mainbranch. More details might exist in #444.I agree we should revisit this for immutable tagging! Perhaps the release branch is created and tagged before publishing a release?
Let's keep this issue open towards an updated publish workflow. In the meantime I might suggest using hashes with a version comment:
The kind @dependabot does well with updating that comment, but I agree that this might not be a great workaround 🤖
AskeFC commentedon Apr 14, 2026
Would you kindly consider using Immutable Releases ?
zimeg commentedon Apr 22, 2026
@AskeFC Thanks for the bump! I'm understanding now that immutable releases are not the same as immutable tags so we can perhaps make this change as we revisit or publishing process 📚
slack-github-action/.github/maintainers_guide.md
Line 77 in dd817b0
The current approach prefers an automated release that creates tags that are moved. Let's explore other options now 🤓
zimeg commentedon Apr 23, 2026
🚀 The most recent
v3.0.2release is immutable! Thanks again for sharing this with us 📰 ✨