releases: Thoughts on using GitHub immutable releases?

[stephen-fox]

In October of 2025, GitHub released a new feature called "immutable releases". To summarize, the new feature can be enabled at the repository or organization level and does the following for newly created tags and releases:

• Prevents deletion of git tags associated with immutable releases
• Prevents addition, modification, or deletion of GitHub release "assets"
• Auto-generates attestations in Sigstore bundle format for releases

My understanding is that this feature effectively only applies to new releases that are marked as immutable. It sounds like existing releases need to be republished to use it.

After the recent "hacketbot" campaign, the trivy project's main repository was compromised through the pull_request_target workflow footgun. As a part of trivy's response to the compromise, they enabled immutable releases - which is how I learned about this feature.

I saw that rizin commit c187aeeb5 removed a recently-added workflow that had the same footgun, which then reminded me of the trivy incident :)

I figured I would mention the immutable releases feature in case it is news to the rizin maintainers as well.

[Rot127]

This sounds like a good thing to use.

I saw that rizin commit c187aeeb5 removed a recently-added workflow that had the same footgun

Checked it yesterday night again and it was not vulnerable luckily.
The user controlled input for the workflow were the commit messages.
The workflow had a line of echo "$USER_PROVIDED_COMMIT_MESSAGES" and I thought that if the commit message contains $GITHUB_TOKEN it could leak that secret.
But I haven't been around pen-testing 10 years ago, otherwise I would have known that echo doesn't resolve nested variables. It would simply print User commit message ... $GITHUB_TOKEN ... (instead of the token itself).

[stephen-fox]

Got it, and thank you for the explanation. And to be clear - I wish GitHub provided something less footgun-y ways to do these kinds of things. The template string stuff (${{ }}) is already super easy to misuse. Thank you for considering the security angle on this stuff, it has a lot of sharp edges.

[Rot127]

Yeah, would be awesome to have tokens which can do exactly one task (assign labels) an nothing else.
But who knows if Github's architecture even allows for such compartmentalization.

[Rot127]

It's tracked now in #6037