Record GitHub release immutability for GitHub Actions packages

[algomaster99]

Currently, packages.ecosyste.ms returns version info (e.g. https://packages.ecosyste.ms/api/v1/packages/lookup?purl=pkg:githubactions/actions/checkout) but has no field indicating whether the underlying GitHub release is locked/immutable. GitHub exposes this via GET /repos/{owner}/{repo}/releases in immutable: boolean attribute. See: https://api.github.com/repos/actions/checkout/releases.

This is useful for tools like https://github.com/chains-project/yul so that they can recommend releases that are immutable.

[andrew]

The first part is in ecosyste-ms/repos#1172. It records and exposes GitHub release immutable values, with an Actions-first backfill sourced from the packages registry names endpoint. Once that is merged and deployed, packages can consume the new field.

[algomaster99]

What is the difference between these two repos -- repos and packages?

[andrew]

repos stores source repository data such as tags and releases. packages stores registry package data such as versions and dependencies. For GitHub Actions, packages maps data from repos into Action versions.

[andrew]

Draft packages PR: #1758

It stores GitHub release immutability in Action version metadata, exposes it in the version API, and adds a batched backfill. It depends on ecosyste-ms/repos#1172.

[andrew]

Currently backfilling the repos side of things, once that is done, i'll backfill the packages side

[algomaster99]

Sounds good! Thanks!