A maintainer wants predictable updates for consumers of a custom action: immutable full-SHA references for strict consumers and an intentionally moving major-version reference for consumers accepting compatible updates. What release approach supports both?

1. Repoint every old version tag to the newest release, regardless of its compatibility.
2. Assume a mutable tag is cryptographically equivalent to a full commit SHA.
3. Publish versioned releases and documented major-version references, while allowing consumers to pin a reviewed full commit SHA.
4. Force every consumer to use the default branch with no release history.