If tags are the way people want to work, then there needs to be a new repo class for actions which explicitly removes the ability to delete or force push tags a

If tags are the way people want to work, then there needs to be a new repo class for actions which explicitly removes the ability to delete or force push tags across all branches. And enforced 2FA. Using a commit hash is the second most secure option. The first (in my eyes) is vendoring the actions you want to use in your user/org's namespace. Maintaining when/if to sync or backport upstream modifications can protect against these kinds of attacks. However, this does depend on the repo being vetted ahead of time, before being vendored.