Any objections against turning on immutable releases for Git for Windows?

[dscho]

As per https://github.blog/changelog/2025-10-28-immutable-releases-are-now-generally-available/, there is now an option to opt into immutable releases. This would provide a little bit of confidence in Git for Windows, as releases could not be tampered with after being released by the automation.

Does anyone see any downside?

Side note: We cannot do this org-wide because https://github.com/git-for-windows/git-sdk-64/releases/tag/ci-artifacts needs to stay a "rolling release", i.e. it will be modified frequently, intentionally so. But we could consider opting other repositories into immutable releases, e.g. the Actions (like setup-git-for-windows-sdk) or https://github.com/git-for-windows/pacman-repo or https://github.com/git-for-windows/git-snapshots.

I am looking in particular for feedback from my friendly co-maintainers, @rimrul and @mjcheetham.

[rimrul]

This would provide a little bit of confidence in Git for Windows, as releases could not be tampered with after being released by the automation.

Presumably this would already prevent modifications during the automation. We need to keep in mind that for https://github.com/git-for-windows/git
we create a release and then update it twice in automation.
https://github.com/git-for-windows/git-for-windows-automation/blob/main/.github/actions/github-release/action.yml

[dscho]

Right, but we create it in draft mode, and the official guidance is to create a draft release, then attach all assets, then publish, i.e. exactly what we do. (You cannot create a release via REST API with assets, the asset uploading is always a separate step, so they have to support this scenario, and they do, via draft releases.)

[dscho]

we create it in draft mode

Here, we call createRelease() with 8 parameters, the 9th (draft) is therefore undefined, which is interpreted as true.

Side note: The best practice these days seems to be to convert the positional parameters to an object with named parameters, that would make this clearer, I guess.

[rimrul]

I guess making the draft immutable would defeat the purpose of a draft. We do convert from draft to non-draft in the first update though and then update again to create a discussion. That probably continues to work, but we should test that.

[dscho]

That's a good point! We likely need to revert git-for-windows/git-for-windows-automation@b59f512.

[derrickstolee]

I'll just give an extra 👍 to making the actions be immutable releases, too. That plugs a big security hole whenever you refer to an action by tag and not commit hash.