On enforcing immutable tags

[GaetanLepage]

Bug description

Hello,
I'm contacting you as the nixpkgs maintainer of pytorch-lightning.
I recently noticed that the 2.6.4 tag was force-pushed.
As far as I'm aware, this is a generally discouraged practice as many consumers are expecting semantic git tags to remain immutable.

Was this action made on purpose? Would it be possible to avoid repeating such actions in the future?

The follow article expands on the concept of Immutable releases:
https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases

Thanks a lot in advance for your help.

What version are you seeing the problem on?

v2.6

Reproduced in studio

No response

How to reproduce the bug

DNA

Error messages and logs

DNA

Environment

DNA

More info

No response

cc @ethanwharris

[deependujha]

Hi @GaetanLepage, thank you for raising this and for your work maintaining the nixpkgs package.

We've confirmed that the 2.6.4 tag was indeed force-pushed. This was possibly due to a mistake where the original release PR (#21701) was incorrectly targeted at release/2.6.x instead of release/stable. PR #21727 corrected this, which resulted in the tag being updated to point to the right commit.

Also worth noting, we've just released 2.6.5 (tag 2.6.5, commit be98784), which is a clean tag with no such issues. You may want to update your nixpkgs package to this version.

https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.5

As there's no further actionable item here, I'll go ahead and close this issue. Thanks again for flagging it!

[GaetanLepage]

Thanks for the reply!

FYI, you can toggle "Immutable releases" in your repository settings, which will prevent this mishap from happening again:

Thanks also for mentioning 2.6.5, I've opened a PR to update our package:
NixOS/nixpkgs#525131

Cheers!