Ok, I’ll try to address everything in order:
Yeah I think so. I’m not sure that it handles updates, but it could be made to do so.
This was already discussed, but some additional information: Even if it were in Julia, it’s a Docker image so the Julia download would only be at build time. So users would not download Julia, they would download a Docker image that has Julia preinstalled.
I would have liked to have written it in Julia,.
But I’ll be totally honest: Python is objectively better for this stuff right now. I’m not saying Julia won’t be a better general purpose language one day in the future (I really want it to be!) but changelog template support would be far worse without Jinja, and GPG password support would not exist without python-gnupg. In its current state, TagBot finishes its run before a Julia-implemented TagBot would finish compiling stuff. Obviously performance is less important when it’s running in the background without your knowledge, but hey, with potentially 2000 jobs every hour I think that the energy savings are substantial. I’ve gotta make up for the huge number of CI jobs I triggered yesterday… 
Also, my dev experience has been far better. Because the code is basically one giant ball of side effects, testing it is really hard without a good, convenient mocking library and unittest.mock is far ahead of Julia alternatives (I say this as someone who maintains a mocking library!). The test suite with ~100% coverage, static analysis, lint checking, and format checking takes less than 3 seconds. I’d imagine the Julia equivalent to take minutes.
In the future, you probably could rewrite it in Julia and be successful; it’s only ~600 LOC.
This was an oversight by me. I’m sorry. I disabled those emails on my own account a long time ago and I totally forgot that they were a thing.
I also didn’t really expect the PR to be merged by any really old packages that don’t have a Project.toml, and I didn’t explain that thoroughly enough above.
To be clear now: TagBot is only for “modern” packages that want to be registered in a registry. If your package is being developed and registered presently, you should definitely have a Project.toml. If it’s not, you should not bother installing TagBot.
I’ve updated TagBot to no longer error in this case.
You can if you want, it’s a good idea because it immediately revokes my access to your packages through the App. But if you don’t, the App will still not run on your packages because it checks first to see if the Action is set up.