A mutable tag is a version label that can be moved from one commit to another. In Git and CI/CD systems, tags are often used to point to a release or action version, but unlike a full commit SHA, a tag does not guarantee that the same code will always be fetched.
This matters in cyber security because attackers can abuse tag drift in supply-chain paths. If a workflow references a third-party GitHub Action by tag, the code that runs later may differ from the code that was reviewed earlier. A tag can be changed intentionally by a maintainer or hijacked after compromise, turning a trusted dependency into an unsafe one. Defenders reduce this risk by pinning workflows to a full commit SHA, limiting workflow permissions, and auditing any reference that still uses a tag or branch name.