Agent Wranglers

ENG-42Recommended

Make release tags and files immutable

Once a release is published, its tag never moves and its files never change. A fix ships as a new version.

By Agent Wranglers. Updated .

How to do it

A moved tag or a swapped release file ships code under a version that people already trust and tested. Turn on immutable releases in GitHub, or protect release tags in GitLab, so nobody can move or delete them. Create the release as a draft, attach every file, then publish it, because the files lock when it is published. Name versions as Stamp every build with its version says. Consumers verify the files as Build releases only in CI and verify them before deploy describes. Sign each release file as use Trivy for the bill of materials and cosign to sign releases shows.

Examples

Shell example

# Publish: attach every file to a draft, then publish once
gh release create v2.4.1 --draft --verify-tag shop.tar.gz shop.sbom.json
gh release edit v2.4.1 --draft=false

# Check: moving a published tag must fail
git tag -f v2.4.1 HEAD
if git push --force origin v2.4.1; then echo "FAIL: release tag moved"; exit 1; fi

How to check

Point an existing release tag at another commit and force-push it. The code host refuses the push. Try to delete or replace a file of a published release. The code host refuses that too.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/engineering/build-test-and-deploy/immutable-releases">Agent Wranglers engineering playbook</a>. In code you write, add a comment next to it with the same link.