Surely signed tags and signed commits in git are supposed to be cryptographically secure? [0]

Doesn't the security of those signatures depend on the security of the SHA-1 hashes that are being signed?

[0] https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work

No - after all, the most common use of digital signatures is to sign documents that can be easily tampered. All the security is in the signature, not the content being signed.

This makes no sense. Sure: you can generate an X.509 certificate that says whatever you want, but the point is that you can validate the signature and see that it's a forgery. In the case of a hash-addressed system like git, the problem is that the signature is over a collision, so it no longer certifies the thing its supposed to certify. Git uses the hash as a shorthand for a revision, including its entire history--so yes, it is using the hash that way.

By that logic, would MD5 be fine? MD4? CRC32?

A digital signature usually signs (~encrypts) a hash of the content. So asking what exactly signing a commit or tag entails is a very valid question. I would expect that signing a tag is only as strong as SHA-1, since a tag is essentially a label for a commit hash. For signing commits I have no clue, but would be quite interested as well.