Commit SHA for GitOps

[ap0phi5]

I've been looking at how we can apply purl to GitOps-style deployments where there isn't a tangible package, rather a reference to a Git repository. I know you can use 'Releases' functionality in GitHub etc, however having a think about it, tags are not actually immutable. This leads me to suggest you must reference the commit SHA only. Would this make sense as a standard in purl parlance?

scheme:type/namespace/name@version?qualifiers#subpath
pkg:github-instance/org-name/repo-name@9242dc5f0c4c2932e61245e4fb0e14592ba130

where 9242dc... is the full commit SHA.