One downside of using tags instead of commit hashes is that tags aren't truly immutable. You need to run git tag --delete if you want to change a tag, which isn't a common thing to do, but I'll admit to doing it occasionally when I screw up one of my releases :) Peru wants to make some modest security guarantees about how peru.yaml uniquely defines a tree of files, and that relies on rev generally pointing to a real commit hash. (Questions about SHA-1 collisions and git commits aside.)

I see how it's not truly immutable, but nowadays a lot of repo's have verifiable github actions that automatically build, tag, and release

This feature is optional, you can enable it only for repo's you trust

And also you could just manually input tag versions in your peru.yml then run peru sync to get the same result

Questions about SHA-1 collisions and git commits aside.

What do you mean? Doesn't git just pull the specified rev?

Well I got tired of waiting so I coded an alternative to peru

https://github.com/Araxeus/vendorfiles