Topic
Everything filed under github-actions, across every section.
Turn an inherited protected-tag setup into an explicit release policy: decide who may create, move, or delete version tags, then test the policy with the same identity your release automation uses.
GitHub tag rulesets stop unauthorized tags from being created, moved, or deleted before release publication. Immutable releases protect the tag and downloadable assets after publication; use both for v1.* production releases.
A moved v2.4.0 tag can make the same download URL point to different source code, while an editable release can replace the binary users already trusted. This guide separates Git tags, GitHub releases, tag rulesets, and immutable releases, then builds a practical workflow for locking versioned software.
Replace retired GitHub tag protection rules with tag rulesets without accidentally blocking release automation. This checklist covers pattern inventory, fnmatch scope, safe testing, automation bypasses, and release-policy documentation.
A release tag is a dependency contract, not a label your team can casually move. Learn how GitHub tag-targeting rulesets prevent tag rewrites, where GitHub Releases fit, and how to scope an immutable-tag policy without blocking legitimate development tags.
A Git tag, a GitHub prerelease, and the Latest badge answer three different questions. Use this release engineering workflow to decide when to tag a commit, publish a prerelease, promote stable builds, and explain why tag and release dates differ.
A practical comparison of mutable tags, immutable release references, and full commit-SHA pins for GitHub Actions. Use actions/download-artifact to choose a policy that balances supply-chain security, readable reviews, automated updates, and fast rollback.
CodeQL 2.26.4 adds Go 1.27 support, improves Rust alert locations, and broadens GitHub Actions security detection accuracy. Use this playbook to identify affected repositories, establish a baseline, rerun scans, and review changed results without treating every location change as a new vulnerability.
A practical GitHub Actions migration guide for replacing actions/download-artifact@v3 with v4 without silently changing what your deploy job publishes. Map common download patterns, update artifact producers, and add layout checks to a build-test-deploy pipeline.
Turn a tagged build into a reproducible GitHub Release: upload one immutable build bundle as a workflow artifact, attach that exact bundle to the release, then download and checksum the published asset as a consumer would.