If you leave out the "tag" parameter, you get this message: "OAuth identity empty, Maybe you need to populate it in the Secrets for your workflow, see more in https://docs.github.com/en/actions/security-guides/encrypted-secrets and https://tailscale.com/s/oauth-clients".

Ideally it should mention that the tag parameter might be the issue, or ideally flag a unique error.