Back to Checks
github

Repository has immutable releases enabled

repository_immutable_releases_enabled
Service: repositorySeverity: high
OfficialBuilt-inVerified
Categories:software-supply-chain
Resource Type:NotDefined

GitHub repository has immutable releases enabled to prevent modification or replacement of published artifacts after publication. When enabled, release assets and binaries become tamper-proof, ensuring artifact integrity throughout the software supply chain.

Prowler logoProwlerprowler-provider-github

Risk

If immutable releases are disabled, release assets can be tampered with after publication, allowing attackers to substitute malicious binaries and undermining supply chain integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_immutable_releases_enabled

Recommendation

Enable immutable releases in the repository settings so release artifacts cannot be altered once published.

Remediation

Terraform

resource "github_repository" "<example_resource_name>" {
  name                 = "<example_resource_name>"
  immutable_releases   = true  # Enables immutable releases so the check passes
}

Other

1In GitHub, open the repository and go to Settings > Code and automation > Releases
2Under "Immutable releases", toggle the switch to On
3Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_immutable_releases_enabled(Check):
    """Ensure immutable releases are enabled for GitHub repositories.

    Immutable releases prevent post-publication tampering of binaries and release assets.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Run the immutable releases verification for each discovered repository.

        Returns:
            List[CheckReportGithub]: Collection of check reports describing the immutable releases status.
        """
        findings: List[CheckReportGithub] = []
        for repo in repository_client.repositories.values():
            if repo.immutable_releases_enabled is None:
                continue

            report = CheckReportGithub(metadata=self.metadata(), resource=repo)

            if repo.immutable_releases_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Repository {repo.name} has immutable releases enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Repository {repo.name} does not have immutable releases enabled."
                )

            findings.append(report)

        return findings

References