Use immutable GitHub release feature

[alexprengere]

In light of recent supply chain attacks, I think it would be great to use immutable releases so that the tag cannot be rewritten by an attacker.

This is quite easy to setup as well: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases

[v-gowridurgad]

Hi @alexprengere,
Thank you for creating this feature request. We will investigate it and get back to you as soon as we have some feedback.

[cnemo-cenic]

@gowridurgad do you have an update? this is a pretty simple change, there are significant risks known.

IMO folks should be using commit SHAs for actions anyway, but that is not the norm.

[ericcornelissen]

https://github.com/actions/setup-python/releases/tag/v7.0.0 is an immutable release 🎉

[v-priya-kinthali]

Hello everyone👋,
Thanks for raising this and for the discussion! Immutable releases are now enabled for this action, starting with v7.0.0, to ensure published tags can't be moved to different commits. Closing this as resolved. Thanks again for the suggestion!