Following the precedent here:
https://docs.npmjs.com/cli/version

When the "package version" command is used to set the version of a package

• If the CWD is a Git repository

• And the working directory is clean

• And the tagVersion parameter is not false

tag the current code with a tag named after the version number and commit the box.json. If a message parameter is provided, use it as the commit message. Replace any instance of $version in the message with the actual version that was set.

The following config settings can also be used to control this behavior:

• tagVersion - Default for the tagVersion parameter if not supplied

• tagVersionMessage – Default for the message parameter