apache / apache/infrastructure-asfyaml
Add feature for immutable GitHub releases
- Dominant language
- Python
- Stars
- 16
- Forks
- 23
- Avg merge
- 6h 51m
- Merged PRs (30d)
- 4
Description
Since Oct 2025 GitHub supports so called ["Immutable Releases"](https://github.blog/changelog/2025-10-28-immutable-releases-are-now-generally-available/#how-to-enable-immutable-releases), [docs](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases?utm_source=changelog-docs-immutable-releases&utm_medium=changelog&utm_campaign=universe25). This feature makes the associated Git tag immutable and protects the release assets. It even protects against "repository resurrection attacks" .
Enabling immutable releases on ASF project repositories seems to be a nice addition.
The PyGithub library (newest version 2.8.1, [supported APIs](https://pygithub.readthedocs.io/en/stable/apis.html)) however does not know about this feature yet. There is an [open issue](https://github.com/PyGithub/PyGithub/issues/3408) and a [draft PR](https://github.com/PyGithub/PyGithub/pull/3409) though. OTOH, the endpoints to [check the status](https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#check-if-immutable-releases-are-enabled-for-a-repository), [enable](https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#enable-immutable-releases) or [disable](https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#disable-immutable-releases) are not complex, so using the `Repository.requester()` directly does not seem complicated.
Wonder if it could be made available via `.asf.yaml` via a new github feature in the configuration like this
```yaml
github:
immutable_releases: true|false
```
and an implementation in `asfyaml/feature/github` which evaluates the new configuration, where immutable releases are enabled, if `immutable_releases == true` and disabled if the config is not present or `false`.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with asfyaml/feature/github and the .asf.yaml configuration and schema documentation; review how existing GitHub features are evaluated. Check PyGithub's support and the Repository.requester() endpoints, then verify behavior for true, false, and absent immutable_releases settings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, python, yaml
- Domain
- devops, release
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100