Use sha and ref for upload

Author: ciroque

.github/workflows/build-and-sign-image.yml

@@ -19,7 +19,7 @@ env:
 
 jobs:
   build_and_sign_image:
-    if: ${{ github.event.pull_request.merged }}
+#    if: ${{ github.event.pull_request.merged }}
     runs-on: ubuntu-latest
     permissions:
       contents: read