GitHub has an opt-in option to enforce immutable tags as part of immutable releases.

https://docs.github.com/en/code-security/concepts/supply-cha...