From e4e234c38808cf88848d9208faa91368c69d5026 Mon Sep 17 00:00:00 2001 From: TGPSKI Date: Tue, 4 Aug 2026 19:37:56 -0700 Subject: [PATCH] tag rulesets: add non_fast_forward release-tags-immutable had update, deletion and required_signatures but not non_fast_forward, so a release tag could still be moved by force-push -- which is the thing an immutable tag exists to prevent. update and deletion do not cover it. This repo is the shape the others were normalized to, so the gap propagated: directed-contexts and security-context-spec both HAD non_fast_forward until they were made consistent with this file. --- .github/rulesets/ruleset-release-tags-immutable.json | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/rulesets/ruleset-release-tags-immutable.json b/.github/rulesets/ruleset-release-tags-immutable.json index 86f0145..ad68e91 100644 --- a/.github/rulesets/ruleset-release-tags-immutable.json +++ b/.github/rulesets/ruleset-release-tags-immutable.json @@ -26,6 +26,9 @@ }, { "type": "required_signatures" + }, + { + "type": "non_fast_forward" } ] }