apache / apache/infrastructure-asfyaml

Add feature for immutable GitHub releases

Open
#83 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
16
Forks
23
Avg merge
6h 51m
Merged PRs (30d)
4

Description

Since Oct 2025 GitHub supports so called ["Immutable Releases"](https://github.blog/changelog/2025-10-28-immutable-releases-are-now-generally-available/#how-to-enable-immutable-releases), [docs](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases?utm_source=changelog-docs-immutable-releases&utm_medium=changelog&utm_campaign=universe25). This feature makes the associated Git tag immutable and protects the release assets. It even protects against "repository resurrection attacks" .

Enabling immutable releases on ASF project repositories seems to be a nice addition.

The PyGithub library (newest version 2.8.1, [supported APIs](https://pygithub.readthedocs.io/en/stable/apis.html)) however does not know about this feature yet. There is an [open issue](https://github.com/PyGithub/PyGithub/issues/3408) and a [draft PR](https://github.com/PyGithub/PyGithub/pull/3409) though. OTOH, the endpoints to [check the status](https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#check-if-immutable-releases-are-enabled-for-a-repository), [enable](https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#enable-immutable-releases) or [disable](https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#disable-immutable-releases) are not complex, so using the `Repository.requester()` directly does not seem complicated.

Wonder if it could be made available via `.asf.yaml` via a new github feature in the configuration like this
```yaml
github:
immutable_releases: true|false
```
and an implementation in `asfyaml/feature/github` which evaluates the new configuration, where immutable releases are enabled, if `immutable_releases == true` and disabled if the config is not present or `false`.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with asfyaml/feature/github and the .asf.yaml configuration and schema documentation; review how existing GitHub features are evaluated. Check PyGithub's support and the Repository.requester() endpoints, then verify behavior for true, false, and absent immutable_releases settings.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, python, yaml
Domain
devops, release
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.