I assume you do since you reference theforeman/actions. It feels like this is taking it a step further to also create the tag. I’ve mentally played with the same concept, but never got around to implementing it.
In the past I’ve played around with bump2version · PyPI to automate how to bump. With that it’s actually pretty trivial. Now I must admit that these days I don’t have time to contribute to bump2version anymore and perhaps there are better solutions, but it’s nice to somehow abstract it.
One benefit of manual tags that I do like (but don’t really benefit from today) is GPG signed git tags. Another thing to consider in all of this is that we can’t use 2FA on our releases today. Tim mentioned the other day they are looking into it (on Rubygems).
What we use in our translations (and is more generic):