From 9d88953e577b2a8f3a784a6d4a740c3a261878a8 Mon Sep 17 00:00:00 2001 From: TGPSKI Date: Tue, 4 Aug 2026 19:31:24 -0700 Subject: [PATCH] tag rulesets: restore non_fast_forward Copying conceit's release-tags-immutable dropped non_fast_forward, which directed-contexts and security-context-spec both had before. That is a straight downgrade to tag protection: without it a tag can be moved by force-push, which is exactly what an immutable release tag exists to prevent. Added to every tag ruleset here so no repo is weaker than it was, and so the rule is uniform rather than depending on which repo the definition was copied from. Note: conceit's own tag ruleset still lacks it. --- .github/rulesets/ruleset-release-tags-immutable.json | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/rulesets/ruleset-release-tags-immutable.json b/.github/rulesets/ruleset-release-tags-immutable.json index 86f0145..ad68e91 100644 --- a/.github/rulesets/ruleset-release-tags-immutable.json +++ b/.github/rulesets/ruleset-release-tags-immutable.json @@ -26,6 +26,9 @@ }, { "type": "required_signatures" + }, + { + "type": "non_fast_forward" } ] }