Immutable Tags / Releases

[tim-hanssen]

Recent incidents like with Trivy scanner yesterday showed that retagging versions can create security risks.

A version like v1.2.3 should always point to the same commit.

Proposal:

• Enable tag protection for all releases
• Disallow force-push and deletion of version tags

Why:

• Prevents supply chain risks
• Ensures reproducible builds

[jaydrogers]

I like this idea. Would be open to more discussion if others want to chime in

[tim-hanssen]

If there is no reason not to, it would be nice to enable it.

[jaydrogers]

Sorry for the delay. I was slammed with projects.

So long story short, I'm dumb and forgot that I already do this. I think I used to update the latest tag (like back in 2.x) but I don't do that anymore.

I enabled tag rules and I want to further harden our process.

I also spent some time documenting how this all works here: https://serversideup.net/open-source/docker-php/docs/getting-started/upgrade-guide

Let me know if this all looks good to you. I appreciate your ideas to help improve our security!