Enable immutable releases
Author: hainesCreated Apr 1, 2026Updated Apr 1, 2026
LabelsFeature
Feature
buf-action downloads binaries from GitHub releases. An attacker may replace the binaries for previous releases with malicious payloads, meaning that pinning the version input without also specifying checksum is insufficient to avoid supply chain attacks.
It would be great if you could enable immutable releases in GitHub.
It might also be worth considering enabling immutable tags in Docker Hub for fully-qualified version numbers (i.e. tags matching ^\d+\.\d+\.\d+$)?
Source: bufbuild/buf