Tagging stable releases

Hello,

I'm creating many branches, checkout code, make changes, etc.. At the end, I always merge these branches to the master branch and delete them when I finish,

At the point where my local master repo seems to be stable, I push the changes to an origin repo that is public.

I guess this is a standard cycle, right?

What I'm confused about is how to tag correctly versions that are stable, Should I locally just add a tag and push the tag to the public repo?

Is it enough to use a lightweight tagging for tagging a certain commit as a release? Is it possible later on to checkout a tag, make a change and push the change into the tagged version?

Many thanks,

Asaf.