Maybe use a branch instead?

I'm pretty sure the distribution scripts should not just follow a branch but be updated explicitly (and don't lose that information). The value here should always point to a single commit, either a hash or tag. But I don't think a tag would be really useful.

Exactly, because there is a dependency that the circle config and the distribution scripts have to be the same or compatible versions.

The original idea was tags but I said if you're just going to tag it and use it in one place why not just use the sha.

If a special tag is used instead of a hash, to update we will only delete and tag again instead of creating a commit that changes the hash. But I don't know if it is a good practise.