Merge branch 'trunk' into copilot/fix-gh-attestation-verification

Author: trevrosen

.github/workflows/deployment.yml

@@ -50,7 +50,7 @@ jobs:
         with:
           go-version-file: 'go.mod'
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
         with:
           version: "~1.17.1"
           install-only: true
@@ -103,7 +103,7 @@ jobs:
           security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$keychain_password" "$keychain"
           rm "$RUNNER_TEMP/cert.p12"
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
         with:
           version: "~1.17.1"
           install-only: true
@@ -157,7 +157,7 @@ jobs:
         with:
           go-version-file: 'go.mod'
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
         with:
           version: "~1.17.1"
           install-only: true
@@ -384,7 +384,7 @@ jobs:
             git diff --name-status @{upstream}..
           fi
       - name: Bump homebrew-core formula
-        uses: mislav/bump-homebrew-formula-action@8e2baa47daaa8db10fcdeb04105dfa6850eb0d68
+        uses: mislav/bump-homebrew-formula-action@56a283fa15557e9abaa4bdb63b8212abc68e655c
         if: inputs.environment == 'production' && !contains(inputs.tag_name, '-')
         with:
           formula-name: gh

.github/workflows/homebrew-bump.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Bump homebrew-core formula
-        uses: mislav/bump-homebrew-formula-action@8e2baa47daaa8db10fcdeb04105dfa6850eb0d68
+        uses: mislav/bump-homebrew-formula-action@56a283fa15557e9abaa4bdb63b8212abc68e655c
         if: inputs.environment == 'production' && !contains(inputs.tag_name, '-')
         with:
           formula-name: gh

pkg/cmd/release/create/create.go

@@ -106,6 +106,19 @@ func NewCmdCreate(f *cmdutil.Factory, runF func(*CreateOptions) error) *cobra.Co
 			This may result in the same or duplicate release which may not be desirable in some cases.
 			Use %[1]s--fail-on-no-commits%[1]s to fail if no new commits are available. This flag has no
 			effect if there are no existing releases or this is the very first release.
+
+			## Immutable Releases
+
+			When release immutability is enabled for a repository, the following protections are enforced:
+			- Git tags associated with a release cannot be modified or deleted.
+			- Release assets cannot be modified or deleted.
+
+			Immutability is enforced only after a release is published. Draft releases can be modified
+			or deleted, and the associated git tags can be modified or deleted as well.
+
+			When using the %[1]screate%[1]s command to attach assets to a release, separate API calls
+			are made to create the release as a draft, upload the assets, and then publish the release.
+			Immutability protections will be enforced ONLY after the release is published.
 		`, "`"),
 		Example: heredoc.Doc(`
 			# Interactively create a release