With recent supply chain attacks, it was a frequent scenario that existing releases were changed. Without immutable releases, even with version pinning you can get malicious releases.
To prevent this, enable immutable releases: https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases
With recent supply chain attacks, it was a frequent scenario that existing releases were changed. Without immutable releases, even with version pinning you can get malicious releases.
To prevent this, enable immutable releases: https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases
read the known issues
environment, where applicable: