Repository navigation
Feature request: publish immutable release tags instead of moving v3 #151
Description
We pin this action by SHA:
- uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3Since v3 was moved to a newer commit (#149), the # v3 comment no longer matches, and zizmor reports ref-version-mismatch. This happens again every time v3 moves.
Moving tags is also a supply chain concern: a malicious re-point looks the same as a regular release.
Would you consider publishing immutable tags that are never moved? Any versioning scheme is fine (not necessarily semver, see #112).
Activity
[-]Proposal: publish immutable release tags instead of moving v3[/-][+]Feature request: publish immutable release tags instead of moving v3[/+]reedham-aws commentedon Oct 22, 2026
Hello @kazu728, thank you for reaching out. I think you're right that we need to publish some immutable versions for the action, after that feature was realeased by GitHub. We can keep something like v3 as a floating tag, but v3.0.1 (for example) would be immutable. Marking this as a feature request.