[FEAT]: Release Immutability

[texonidas]

Describe the need

There is a checkbox on the repository level settings to enable release immutability, which is not present on the provider.

SDK Version

No response

API Version

No response

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct

[ViacheslavKudinov]

Hi,
with current release flow it will not work if just to set this checkbox as Goreleaser will not be able to upload artifacts to release.
I've tested on my fork repo and it generates the errors like

• uploading to release                         file=dist/terraform-provider-github_0.0.5_windows_arm.zip name=terraform-provider-github_0.0.5_windows_arm.zip
      • upload failed                                request-id=5000:11C746:FB95F2:11D9F88:69010C53 error=POST https://uploads.github.com/repos/vk-or/terraform-provider-github/releases/257925857/assets?name=terraform-provider-github_0.0.5_linux_arm64.zip: 422 Cannot upload assets to an immutable release. [] name=terraform-provider-github_0.0.5_linux_arm64.zip release-id=257925857

or simply

422 Cannot upload assets to an immutable release.

Please, see the effect of just enabling this feature https://github.com/vk-or/terraform-provider-github/actions/runs/18885255041/job/53898802960#step:5:77

PS after deleting the tag v0.0.5 and the release and option is disabled, i still can't re-use this version. Maybe it is a bug or expected, will check if any "discussion" about this feature/behaviour.

[ViacheslavKudinov]

Potentially we can add GitHub attestation and also to add tags protection via Rulesets https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository#creating-a-branch-or-tag-ruleset.
At least it could improve a little bit.

[ViacheslavKudinov]

I just realized that maybe i was doing release not as maintainers usually do.

Could @nickfloyd , please, clarify how release usually done on the repo?
Is it just push of tag? UI process with release and tag at the same time? Something else?

I could try to do the same on my fork with enabled immutable releases.

[texonidas]

I think there has been a misunderstanding. I'm not suggesting that this repository enable this setting, I'm suggesting that the provider add this as a terraform-controllable attribute for repositories.

[ViacheslavKudinov]

@texonidas
Oh, sorry. My bad.

You are totally correct, I was thinking it's about this repository where we host the code of provider.
Please, disregard my previous comments.

This issue is to add ability to manage this setting of repository by provider.

[ViacheslavKudinov]

I see that it is actually is duplicate of #2746 and probably should be closed.

[nickfloyd]

I just realized that maybe i was doing release not as maintainers usually do.

Could @nickfloyd , please, clarify how release usually done on the repo? Is it just push of tag? UI process with release and tag at the same time? Something else?

I could try to do the same on my fork with enabled immutable releases.

Hey @ViacheslavKudinov our release process is documented here. Please let me know if you have any questions.

[ViacheslavKudinov]

Hey @ViacheslavKudinov our release process is documented here. Please let me know if you have any questions.

@nickfloyd thank you for pointing me to this md file.
So, seems i was doing the right things. It means release + tag are done via UI and it will not work if to just enable immutable release on this provider repo.
But as this issue was about to add feature to provider to be able to do it, it's not really related to this issue itself.

It could be still valuable to think about improving security by doing immutable releases or tag protection, but not as part of this issue, sorry it was my initial misunderstanding.