@@ -10,9 +10,9 @@
   2. writes `Formula/serpapi-cli.rb` in `serpapi/homebrew-tap` from those checksums and pushes it as a `serpapi-cli <version>` commit.
 - To release by hand, run the CI workflow on `main` from the Actions tab with a bump (`dry_run` is on by default), or push a lightweight `v*` tag on a `main` commit whose CI passed with no `--- SKIP` in the e2e log; `release.yml` runs on the pushed tag.
 - If a release job fails after the tag was made, re-run the failed jobs of that CI run, or, once the cause is fixed on `main`, run the Release workflow from the Actions tab with that tag. The tag stays.
-- `release.yml` refuses a tag that doesn't point at the tested commit or is older than the newest release (it would become "latest" and roll Homebrew back), and publishes one release at a time. A published version is never built again, since a newer Go would change binaries users may already have: a complete release only gets its Homebrew formula refreshed, and a partial one, from a failed upload, stops it. Release the next version instead: run CI on `main` from the Actions tab with bump `patch`.
+- `release.yml` refuses a tag that doesn't point at the tested commit or is older than the newest release (it would become "latest" and roll Homebrew back), and publishes one release at a time. A published version is never built again, since a newer Go would change binaries users may already have: a complete release only gets its Homebrew formula refreshed. GoReleaser uploads to a draft and publishes it last, so a failed upload leaves an unpublished draft: delete the draft on the Releases page, then re-run. A published release with missing files stops the run; release the next version instead: run CI on `main` from the Actions tab with bump `patch`.
 - `.github/scripts/release-tag-test.py` tests `release-tag.sh` offline in scratch repos; CI runs it before the `tag` job.
-- Never move, delete or reuse a published tag: Go's module proxy and checksum database keep the first content they saw for each version, so a moved tag never reaches most `go install` users and fails checksum verification for the rest.
+- Never move, delete or reuse a published tag: Go's module proxy and checksum database keep the first content they saw for each version, so a moved tag never reaches most `go install` users and fails checksum verification for the rest. A repository ruleset blocks updating or deleting `v*` tags for everyone, admins included; creating them, as CI does, stays allowed. Releases are immutable once published, from v0.3.1 on: their tag and files are locked, while the title and notes stay editable.
 - v0.2.1 to v0.2.3 are tagged on `go-rewrite`, which `main` doesn't contain; `release-tag.sh` compares files with the latest release, not history.
 - To change a published release's notes: `gh release edit v0.3.0 -R serpapi/serpapi-cli --notes-file <file>`.
 - Release binaries build with the latest stable Go (`go-version: stable`); the `go` line in `go.mod` is the oldest Go that `go install` users need.