make releases immutable for supply chain attack security

[dangbert]

TL;DR

Can we consider enabling "immutable" releases on this repo to reduce the risk of supply chain security attacks?

https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases#what-immutable-releases-protect

Detailed design

No response

Additional information

No response

[dangbert]

Here's a related article from astral wherein they explain their approach is to "require all actions to be pinned to specific commits (rather than tags or branches, which are mutable)". So in my CI I could already do so like this

    - name: Setup gcloud
      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3

but I was curious if we could start a discussion about using immutable releases directly on this repo so uses: google-github-actions/setup-gcloud@v3 would also be immutable?

In practice most users are unaware of these details, most docs (including this repo's README.md) don't suggest pinning to specific commits, and it's a bit ugly.

The threat model here is that if any of my 3rd party actions like from google-github-actions have their accounts or CI/CD compromised then an existing release could be overwritten with a malicious one and execute malicious code in the CI/CD (and related GCP infra) of thousands of Github projects.