We should use repository rulesets to prevent the deletion or modification of released tags and critical release branches

[jbampton]

We can setup rules for released tags and also other branches. See our rules:

https://github.com/apache/cloudstack/rules/

Not 100% sure but seems like anyone with write access can delete releases and checkout the pictures attached

See Apache Flume they have tag protection setup in their .asf.yaml:

https://github.com/apache/logging-flume/blob/7b41e071caf1566bf73add2f40b530875d61da10/.asf.yaml#L94

---

Yes, an Apache Software Foundation (ASF) project should use repository rulesets to prevent the deletion or modification of released tags and critical release branches.

Benefits of Using Rulesets for Releases

• Supply Chain Security: Restricting deletions and updates on tags prevents malicious or accidental tampering with published software artifacts.
• Flexibility and Targeting: Unlike legacy branch protection, GitHub Rulesets can target tags using naming patterns (e.g., v* or specific release tags) alongside branches.
• Audit Transparency: Anyone with read access can view active rulesets, helping project auditors verify compliance and governance without requiring admin privileges.
• Preventing Force Pushes: Rulesets allow projects to block force-pushes and restrict deletions to designated release managers or PMC members.

Recommended Practices

• Set rulesets to Active enforcement for any matching patterns of released tags or stable maintenance branches.
• Restrict bypass permissions strictly to trusted release officers or infrastructure administrators.