github-community-projects / github-community-projects/safe-settings
Is it possible to add `Enable release immutability`?
- Dominant language
- JavaScript
- Stars
- 921
- Forks
- 226
- Avg merge
- 18h 3m
- Merged PRs (30d)
- 14
Description
## Prerequisites:
* Is the functionality available in the GitHub UI? If so, please provide a link to information about the feature.
The checkbox exists in the UI:
The GitHub documentation has a page dedicated to them: https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases.
* Is the functionality available through the GitHub API? If the functionality is available, please provide links to the
API documentation (https://developer.github.com/v3/) as well as the Octokit documentation (https://octokit.github.io/).
The feature exists in the GitHub API: https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10&versionId=free-pro-team%40latest&productId=rest#enable-immutable-releases
## New Feature
[Immutable releases](https://github.blog/changelog/2025-10-28-immutable-releases-are-now-generally-available/) were released in October 2025 as another security measure to help maintainers protect their releases from malicious attacks. This feature is increasingly used in OSS projects, and I think it would be great to enforce from a safe settings point of view.
Note for organisations one can turn them on globally (Settings > Repository > General > Releases) either for all repositories or select certain repos. The disadvantage with this is it's not infrastructure as code (which is a big benefit of Safe-Settings), but is also not available on personal accounts (which Safe-Settings does work on).
Contributor guide
Assessment
This issue has not been assessed yet.