Prerequisites:
New Feature
Immutable releases were released in October 2025 as another security measure to help maintainers protect their releases from malicious attacks. This feature is increasingly used in OSS projects, and I think it would be great to enforce from a safe settings point of view.
Note for organisations one can turn them on globally (Settings > Repository > General > Releases) either for all repositories or select certain repos. The disadvantage with this is it's not infrastructure as code (which is a big benefit of Safe-Settings), but is also not available on personal accounts (which Safe-Settings does work on).
Prerequisites:
Is the functionality available in the GitHub UI? If so, please provide a link to information about the feature.
The checkbox exists in the UI:
The GitHub documentation has a page dedicated to them: https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases.
Is the functionality available through the GitHub API? If the functionality is available, please provide links to the
API documentation (https://developer.github.com/v3/) as well as the Octokit documentation (https://octokit.github.io/).
The feature exists in the GitHub API: https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10&versionId=free-pro-team%40latest&productId=rest#enable-immutable-releases
New Feature
Immutable releases were released in October 2025 as another security measure to help maintainers protect their releases from malicious attacks. This feature is increasingly used in OSS projects, and I think it would be great to enforce from a safe settings point of view.
Note for organisations one can turn them on globally (Settings > Repository > General > Releases) either for all repositories or select certain repos. The disadvantage with this is it's not infrastructure as code (which is a big benefit of Safe-Settings), but is also not available on personal accounts (which Safe-Settings does work on).