Add GitHub immutable releases

[snazy]

Adds functionality to enable immutable GitHub releases using a new feature configuration:

github:
  # Default is false.
  immutable_releases: true|false

Fixes #83

[raboof]

this seems great!

I wonder if this should even be enabled by default, given AFAICT this is the spiritual successor of the earlier tag protection (#85) which IIRC was also enabled by default?

[jbonofre]

That's cool !

Maybe we would consider to enable it by default, but some projects might be "surprised".

[snazy]

IMHO immutable releases should be the default. I'm just not sure whether that could break existing "moving tags" use cases like for GitHub actions v42.

Maybe it can become the default after a "heads up" email saying that "immutable releases" will become the default on some day X?

[jbonofre]

Yeah, that's a good point, and also my question. Is it a way to do a check on projects without changing the flag ? I guess not.

[snazy]

Ah, you remind me that there is at least Arrow who have "immutable releases" enabled manually via an ASF Infra.
I think, they should get a heads-up so they can add the setting before or shortly after the PR is merged, so we do not make Arrow releases "mutable".

[raboof]

Maybe we would consider to enable it by default, but some projects might be "surprised".

Then they can just disable it, right?

[snazy]

(Err, not Arrow, but Airflow - at least I got the first and last letters right)

Actually, I was right with Arrow INFRA-27392

And Pekko via INFRA-24644

[potiuk]

Nice!

[snazy]

Pinged dev@pekko and dev@arrow ML about this PR.

[raulcd]

Nice, thanks for pinging the arrow dev ML. I requested it initially there. This is great! As per the default just in case this is relevant it would have broken our workflow if enabled without notice as we had to change to have our Release candidates (pre-releases) to be in draft mode so we could append new artifacts (binaries) while those are being generated. Based on our process those are created after source which is initially uploaded to the draft. Draft releases are not immutable and allow for adding more artifacts. Once we have uploaded all artifacts we remove the draft mode to make the Release Candidate also immutable.

Do we have to update .asf.yaml once this is merged or can we do it now? I am in the middle of a Release, just waiting for the vote to finish during the next couple of days, that's why I am asking :)

[snazy]

Do we have to update .asf.yaml once this is merged or can we do it now?

IIUC (I'm rather a Python noob) I think the answer is after this PR is being merged, because strictyaml is being used to parse .asf.yaml.

[raulcd]

Thanks @snazy ! No worries, I've subscribed and will act promptly once I see this being merged! Thanks for doing this!