This is one of the cleanest and nicest "release from a tag securely" builds on github. Also their process to propose a new release is equally based:

https://github.com/caddyserver/caddy/blob/master/.github/wor...