how can you reliably tie a release to a version of code

The action adds tags to your release with the commit sha and PR id. These tags though can be easily deleted from the dashboard. Since these are the only way to lookup what version of source code made that release, this can be pretty unreliable.