A quirk here- tags are not actually immutable in git. I agree with the premise, and use tags myself for releases, but if you rely on them being immutable then you have loaded a footgun