Enhancement request: Need to have releases

[richsalz]

Right now, everything seems to be done by checking into master; there's no releases or tagging.I want to use ossf/scorecard but I'll get dinged for not pinning specific hashes. I can pin a specific git commit, but things like dependabot don't see a release so that's no help.

Please see ossf/scorecard#1500 for some background.

[evverx]

I think it's probably the same issue as #6836

[richsalz]

Yes, I will close this as a dup of #6836, thanks!

[evverx]

Looks like neither CIFuzz nor CFLite can be pinned properly so I'll go ahead and close #6836. CFLite can't be unpinned either though: google/clusterfuzzlite#95 so once it's resolved I'll unpin it and ignore scorecard.