starred/act

Fork 0

mirror of https://github.com/nektos/act.git synced 2026-04-26 01:15:51 +03:00

[GH-ISSUE #5922] Immutable releases #1287

New issue

Open

opened 2026-03-01 21:50:10 +03:00 by kerem · 5 comments

kerem commented

2026-03-01 21:50:10 +03:00

Owner

Originally created by @laraibg786 on GitHub (Sep 3, 2025).
Original GitHub issue: https://github.com/nektos/act/issues/5922

Act version

N/A

Feature description

Currently the releases are mutable and hence the integrity of a release cannot be verified. Please turn on the immutable release for this repo if appropriate.

More on this:
https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/preventing-changes-to-your-releases
https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases

Originally created by @laraibg786 on GitHub (Sep 3, 2025). Original GitHub issue: https://github.com/nektos/act/issues/5922 ### Act version N/A ### Feature description Currently the releases are mutable and hence the integrity of a release cannot be verified. Please turn on the immutable release for this repo if appropriate. More on this: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/preventing-changes-to-your-releases https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases

kerem added the

kind/feature-request

label

2026-03-01 21:50:10 +03:00

kerem commented

2026-03-01 21:50:11 +03:00

Author

Owner

@ChristopherHX commented on GitHub (Sep 3, 2025):

Does the goreleaser can successfully upload all assets when immutable releases are on?

The answer could be yes, but I have no idea.

On the other hand I can not toggle this setting here, the admin didn't commit code for long

@ChristopherHX commented on GitHub (Sep 3, 2025): Does the goreleaser can successfully upload all assets when immutable releases are on? The answer could be yes, but I have no idea. _On the other hand I can not toggle this setting here, the admin didn't commit code for long_

kerem commented

2026-03-01 21:50:11 +03:00

Author

Owner

@laraibg786 commented on GitHub (Sep 4, 2025):

This is just a toggle that prevents editing/modifying the existing release including assets etc. New releases should work as before so I don't think goreleaser will have any problem with releases.
Anyways this will require input for admin of the repo or organization.

@laraibg786 commented on GitHub (Sep 4, 2025): This is just a toggle that prevents editing/modifying the existing release including assets etc. New releases should work as before so I don't think goreleaser will have any problem with releases. Anyways this will require input for admin of the repo or organization.

kerem commented

2026-03-01 21:50:11 +03:00

Author

Owner

@ChristopherHX commented on GitHub (Sep 4, 2025):

New releases should work as before

Then I might be using unserious actions side by side, one of them did publish a release before all assets were uploaded. It's name ncipollo/release-action recommend by the abandoned official release upload action. Even that action received an update, but they decided that I would have to alter my workflow to enable support :(....

Based on https://goreleaser.com/customization/release/ yes the docs suggests goreleaser correctly create a draft first, upload everything then publish if not skipped by draft: true

Now only cplee can actually do this, for actions-oss/act-cli I can make this reality.

@ChristopherHX commented on GitHub (Sep 4, 2025): > New releases should work as before Then I might be using unserious actions side by side, one of them did publish a release before all assets were uploaded. It's name ncipollo/release-action recommend by the abandoned official release upload action. Even that action received an update, but they decided that I would have to alter my workflow to enable support :(.... Based on https://goreleaser.com/customization/release/ yes the docs suggests goreleaser correctly create a draft first, upload everything then publish if not skipped by draft: true Now only cplee can actually do this, for actions-oss/act-cli I can make this reality.

kerem commented

2026-03-01 21:50:11 +03:00

Author

Owner

@laraibg786 commented on GitHub (Sep 17, 2025):

I have tested the compatibility of our current CI pipeline with GitHub's immutable releases. No workflow changes are required for enabling immutable releases works seamlessly with our existing setup.

@ChristopherHX Could you please review this and, if everything looks good, tag a repository admin to proceed with enabling immutable releases?

Reference:

Release workflow run: https://github.com/laraibg786/act/actions/runs/17799180860
Resulting immutable release: https://github.com/laraibg786/act/releases/tag/v3.0.0

@laraibg786 commented on GitHub (Sep 17, 2025): I have tested the compatibility of our current CI pipeline with GitHub's immutable releases. No workflow changes are required for enabling immutable releases works seamlessly with our existing setup. @ChristopherHX Could you please review this and, if everything looks good, tag a repository admin to proceed with enabling immutable releases? Reference: - Release workflow run: https://github.com/laraibg786/act/actions/runs/17799180860 - Resulting immutable release: https://github.com/laraibg786/act/releases/tag/v3.0.0

kerem commented

2026-03-01 21:50:11 +03:00

Author

Owner

@ChristopherHX commented on GitHub (Sep 17, 2025):

Yes immutable releases can be enabled in GitHub Settings with no impact for both act and gh-act. Confirmed in my forks as well.

One of my repos goes one step further, by packaging a vendored version with all dependencies bundled to allow offline compiling changes even if some dependency disappears.

@cplee Your turn / decision for enabling this here.

tag a repository admin

I usually do not do something like that

@ChristopherHX commented on GitHub (Sep 17, 2025): Yes immutable releases can be enabled in GitHub Settings with no impact for both act and gh-act. Confirmed in my forks as well. One of my repos goes one step further, by packaging a vendored version with all dependencies bundled to allow offline compiling changes even if some dependency disappears. @cplee Your turn / decision for enabling this here. > tag a repository admin _I usually do not do something like that_

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/act#1287

No description provided.

Rows
Columns