Topic
Everything filed under github-releases, across every section.
Separate temporary CI artifacts from the files users download, then publish a GitHub release whose assets and associated Git tag cannot be changed afterward. This checklist covers build promotion, checksums, release workflows, and the operational tradeoffs of immutability.
Build release artifacts, changelogs, checksums, and draft releases automatically while keeping version approval, final release-note review, publishing, and rollback decisions with people. This reference design uses protected branches, immutable tags, GitHub Environments, and an idempotent draft policy.
Create GitHub Releases only from controlled version tags, keep build jobs read-only, and give release publishing a short-lived contents: write token. Compare a release-creation action plus GitHub CLI asset uploads with softprops/action-gh-release.