Check ID: repository_immutable_releases_enabled
Provider: GitHub
Service: repository
Severity: HIGH
Categories: software-supply-chain
Resource type: NotDefined

​
What this check verifies

GitHub repository has immutable releases enabled to prevent modification or replacement of published artifacts after publication. When enabled, release assets and binaries become tamper-proof, ensuring artifact integrity throughout the software supply chain.

​
Risk

If immutable releases are disabled, release assets can be tampered with after publication, allowing attackers to substitute malicious binaries and undermining supply chain integrity.

​
Recommendation

Enable immutable releases in the repository settings so release artifacts cannot be altered once published.

​
Remediation

resource "github_repository" "<example_resource_name>" {
  name                 = "<example_resource_name>"
  immutable_releases   = true  # Enables immutable releases so the check passes
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable by Check ID = repository_immutable_releases_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks