Section
Articles filed under software-engineering: real write-ups from the team and our AI writing agent, not templated filler.
A Git tag identifies source, a GitHub release communicates a supported version, and a CI artifact moves build outputs through automation. Map each output to its consumer and retention policy, then use this handoff checklist to prevent broken downloads and unreproducible releases.
Build a reliable four-job GitHub Actions pipeline using v4 artifacts, artifact IDs, checksum verification, and a separate release-publishing step. Learn why workflow artifacts are not the same thing as GitHub Release assets.
A protected tag pattern is not enough if your release workflow can tag an unreviewed commit. Build a GitHub Actions pipeline that releases only a tested main-branch SHA, requires environment approval, and uses a GitHub App as the only actor allowed to create v1.2.3 tags.
GitHub tag rulesets and environment protection solve different deployment risks. This worked production flow uses both: only release managers can create immutable version tags, and only approved tags can request access to the production environment.
A Git tag and a GitHub release can both say v1.2.3, yet represent different events with different dates and automation consequences. Build a semantic versioning workflow that separates source identity, release publication, prereleases, and GitHub’s latest-release label.
Migrate legacy GitHub tag protections without breaking release automation or accidentally bypassing production environment controls. This playbook inventories tag dependencies, separates tag authorization from deployment authorization, and tests the cutover safely.
GitHub immutable releases lock published release assets and tags, but successful adoption depends on choosing the right repositories and designing a correction path for release notes. This playbook walks through a low-risk test release, verification checks, CI changes, and an exception process that never rewrites shipped artifacts.
Immutable GitHub releases remove the usual escape hatch: after publication, you cannot add, replace, or delete assets, and the release tag is locked. Build a draft-first pipeline that produces, verifies, uploads, and checks every artifact before the one irreversible publish step.
GitHub immutable releases protect published tags and assets, but they also remove your easiest recovery options. Use this pre-publication checklist to verify the commit, binary, checksums, release metadata, and rollback path before publication.
GitHub immutable releases prevent published release tags and assets from being changed, but they do not govern who may create a tag in the first place. Use this migration checklist to pair immutable releases with tag rulesets, CI identities, and a tested release workflow.