Do you have configured immutable-releases?

[thisispr]

https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases

if not, would you enabled it?

see here what could be happend, if you not do that
aquasecurity/trivy-action#541

[Romanitho]

I was considering this recently. I hadn't enabled it until now because the auto-generation can sometimes be inaccurate, requiring manual edits. That said, I agree it's an important security improvement. It is now enabled. Thank you.