Would it be possible to start tagging semver-compatible releases?

We follow GitHub's best practice of pinning our Actions to full length commit SHAs.
We use Dependabot version updates to keep our other Actions up to date. This doesn't work with github/codeql-action since there are no released tags.

I think everything would work if there were semver compatible tags (e.g. v1.0.0, v1.1.0 along the v1 branch).