Enable release immutability

[erka]

GitHub provides a repository setting to make releases immutable after publication. Currently, releases/tags in go-sdk and go-sdk-contrib repos can still be modified.

Proposal

Enable Release immutability in the GitHub repository settings

Why

• Guarantees published versions don’t change
• Improves reproducibility and supply-chain trust
• Aligns with OSS release best practices

[beeme1mr]

Done for both the Go SDK and Contrib repos. Thanks for the heads up @erka

[erka]

@beeme1mr We need to revert these changes in both repositories until we have a better release pipeline in place.

Currently, release-please creates a Git tag and a release, and then goreleaser (or action-gh-release) fails in the next step.

It appears that a double release event is triggered and the SBOM is uploaded in the final step. When the release is marked as immutable, this last step never completes successfully.

• https://github.com/open-feature/go-sdk/actions/runs/20974193213/job/60284994153
• https://github.com/open-feature/go-sdk-contrib/actions/runs/20927930134/job/60131196683

While it’s possible to configure release-please to create a draft release, it does not create a Git tag. We can create the Git tag in a separate step and use goreleaser's use_existing_draft option to use and publish it. This approach works, but it has an unpleasant side effect: because release-please does not see the git tag, it generates a subsequent release PR that includes all commits again.

googleapis/release-please#1650

A possible workaround for go-sdk 0c9c5b2

[beeme1mr]

@toddbaert any chance you have a few minutes to help here?

[toddbaert]

Reverted for now. It's a good idea though.