Skip to content

docs: correct what is editable on an immutable release - #45730

Merged
subatoi merged 2 commits into
github:mainfrom
koistya:fix/immutable-releases-editable-fields
Sep 3, 2026
Merged

docs: correct what is editable on an immutable release#45730
subatoi merged 2 commits into
github:mainfrom
koistya:fix/immutable-releases-editable-fields

Conversation

@koistya

@koistya koistya commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Why:

Closes: #45718

"Managing releases in a repository" says that under immutable releases you "can only edit the title and release notes after a release is published." That allowlist is wrong, and it contradicts Immutable releases, which lists exactly two enforced protections: Git tags cannot be moved, and release assets cannot be modified or deleted.

Measured on a repository with immutable releases enabled, against a published prerelease carrying one asset:

  • Accepted — editing the title and notes, and PATCH /repos/{owner}/{repo}/releases/{release_id} with prerelease=false and make_latest=legacy; the release stays "immutable": true.
  • Rejected — uploading an asset (422 Cannot upload assets to an immutable release), deleting an asset, and moving the tag (push declined by repository rules).

Read literally, the old note also rules out promoting a verified prerelease to latest — a release process immutability actually supports.

What's being changed:

  • managing-releases-in-a-repository.md — the note under "Editing a release" becomes a denylist matching the concepts page: no adding, replacing, or deleting assets, and no moving or deleting the tag while the release exists.
  • immutable-releases.md — a sentence under "What immutable releases protect" bounds those protections to the assets and tag; "Best practices" now links to the release-creation instructions rather than restating them.

Both name the editable fields explicitly rather than as examples of a larger set: name, body, prerelease and make_latest were measured; tag_name, target_commitish, draft and discussion_category_name were not, so the wording claims nothing about them.

Check off the following:

  • A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
  • The changes in this PR meet the docs fundamentals that are required for all content.
  • All CI checks are passing and the changes look good in the review environment.

Copilot AI balanced review requested due to automatic review settings September 2, 2026 20:48
@github-actions github-actions Bot added the triage Do not begin working on this issue until triaged by the team label Sep 2, 2026
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source Review Production What Changed
code-security/concepts/supply-chain-security/immutable-releases.md fpt
ghec
ghes@ 3.22 3.21 3.20
fpt
ghec
ghes@ 3.22 3.21 3.20
repositories/releasing-projects-on-github/managing-releases-in-a-repository.md fpt
ghec
ghes@ 3.22 3.21 3.20 3.19 3.18 3.17
fpt
ghec
ghes@ 3.22 3.21 3.20 3.19 3.18 3.17

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

@koistya
koistya force-pushed the fix/immutable-releases-editable-fields branch from 9099d47 to 42bd42e Compare September 2, 2026 20:49

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The restriction list omits that an immutable release’s tag cannot be deleted while the release exists.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Corrects documentation about editable fields on immutable releases.

Changes:

  • Clarifies immutable release restrictions.
  • Documents prerelease verification and promotion.
File summaries
File Description
managing-releases-in-a-repository.md Updates editing guidance.
immutable-releases.md Documents editable fields and verification workflow.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 1
  • Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

"Managing releases in a repository" claimed that only the title and
release notes can be edited after an immutable release is published.
Measured against a repository with immutable releases enabled, a
published release also accepts changes to its pre-release and latest
flags and stays immutable; what is rejected is uploading or deleting
assets and moving the tag. The allowlist also contradicted the concepts
page, which lists exactly those two protections.

Replace it with a denylist, and document on the concepts page that a
release can be published as a pre-release, verified over the public
download path a draft does not offer, and then promoted.

@subatoi subatoi left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, @koistya—I've made some suggested changes before we can merge this. If you'd prefer that I apply these myself so you don't need to do any further work but can still have the attribution, that's fine, please just say so. Thanks again

Comment thread content/code-security/concepts/supply-chain-security/immutable-releases.md Outdated
Comment thread content/code-security/concepts/supply-chain-security/immutable-releases.md Outdated
Review feedback: the new "What you can still change" heading and the
prerelease-verify-promote paragraph were both extra structure on a short
concepts page. Move the editable-fields sentence next to the protections
it bounds, and point at the release-creation docs instead of restating
the process.
@subatoi subatoi added Waiting on contributor and removed triage Do not begin working on this issue until triaged by the team labels Sep 3, 2026
@koistya

koistya commented Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

@subatoi fixed

@subatoi subatoi left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you very much, @koistya! Your help is much appreciated. I'll get this merged now. Thanks for your interest in the GitHub docs.

@subatoi
subatoi added this pull request to the merge queue Sep 3, 2026
Merged via the queue into github:main with commit 81e32d6 Sep 3, 2026
55 checks passed
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours. If you're looking for your next contribution, check out our help wanted issues

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Immutable releases: "you can only edit the title and release notes" is inaccurate

3 participants