bold text in immutable-releases.md

[dangbert]

Why:

Closes: #43715

What's being changed (if available, include any code snippets, screenshots, or gifs):

Make important text bold so it's harder to overlook.

Check off the following:

• A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
• The changes in this PR meet the docs fundamentals that are required for all content.
• All CI checks are passing and the changes look good in the review environment.

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
code-security/concepts/supply-chain-security/immutable-releases.md	fpt ghec ghes@ 3.21 3.20	fpt ghec ghes@ 3.21 3.20

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[Sharra-writes]

@dangbert This doesn't fit within our style guide, however we are moving away from quotes for important items and towards putting them in bold, so this would be acceptable:

If a release is immutable, you will see {% octicon "lock" aria-hidden="true" %} Immutable below the title on the release page.

If you don't think that's sufficient, I really don't like the placement of that callout. Think of text formatting as a means of directing attention. If you direct attention somewhere with a callout, you're basically taking it away from somewhere else, and that "somewhere else" is usually the area immediately following the place where you've directed the attention. That's fine if there's a bunch of text afterward to remind the reader there's more to read, but when you follow a callout with one line of text and then a heading for a new section, that one line of text is going to get lost. I would rather see the callout at the end of the section if there's nowhere further up the section where it makes sense.

But even if the callout gets moved, "Immutable" should still be bolded, because that's what we're doing now.

[dangbert]

Hi sorry for the delay, I believe this now reflects the feedback from @Sharra-writes.

On a broader note, less in immediate scope for this PR, but I think Github could really champion immutable releases as a security feature by demonstrating them across the most popular Github Actions. For example the single most used action, checkout, still doesn't use immutable releases actions/checkout#2316

If Github were to address this in the future the docs could perhaps link to a release in https://github.com/actions/checkout/releases to provide a clear example of what an immutable release looks like.

My motivation for this stems from the hundreds of supply chain attacks over the last year, with most seeming to start with the many foot guns in the security model of Github Actions. One only has to look at all the hoops Atral had to be aware of and jump through to tighten their security footprint on Github https://astral.sh/blog/open-source-security-at-astral

Unfortunately this level of effort is unrealistic to expect for the entire community to be educated about. I believe Google Cloud takes a great approach with their "Secure by default" philosophy.

This is the motivation of my PR and why I've opened a few issues on popular github repos spreading knowledge about Immutable releases. The maintainer of yq thusfar has been the only one I've seen take action in response mikefarah/yq#2673

additional references:

• https://nesbitt.io/2026/04/28/github-actions-is-the-weakest-link.html

[Sharra-writes]

@dangbert Looks good! If you want to discuss your concerns more, I'd recommend https://github.com/orgs/community/discussions.

[github-actions]

Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours. If you're looking for your next contribution, check out our help wanted issues ⚡