A tag is a permanent label for a specific commit — usually a release version. Unlike a branch, tags don't move forward when you commit; they pin one moment in history.
Two kinds:
git tag v1.0.0 — lightweight tag. Just a pointer, no metadata.
git tag -a v1.0.0 -m "Release 1.0" — annotated tag. A real object in Git's database with author, date, and message. Prefer this for releases; git show v1.0.0 displays its notes, and most release tooling expects annotated tags.
Naming follows SemVer: MAJOR.MINOR.PATCH. Major = breaking change, minor = new feature, patch = bug fix.
Tags don't push by default — git push origin v1.0.0 pushes one, git push origin --tags pushes all. CI/CD release pipelines usually trigger on a pushed tag matching v*.