This is one of the cleanest and nicest "release from a tag securely" builds on github. Also their process to propose a new release is equally based:

https://github.com/caddyserver/caddy/blob/master/.github/wor...

Thanks for sharing this, we like it a lot. Mohammed Al-Sahaf implemented this for us so that releases can be made by a quorum of maintainers rather than being blocked by me every time.

Here's the first release done with it: https://github.com/caddyserver/caddy/releases/tag/v2.11.0-be...

And you can see the PR flow where the action happens: https://github.com/caddyserver/caddy/pull/7383