risk: Prepare for SHA references

Author: mprimeaux

.github/workflows/release.yaml

@@ -54,11 +54,11 @@ jobs:
 
       # Ref: https://github.com/sigstore/cosign-installer
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v4.0.0
+        uses: sigstore/cosign-installer@v4.0.0 # v4.0.0
 
       # Ref: https://github.com/anchore/sbom-action
       - name: Generate SBOM via Syft
-        uses: anchore/sbom-action@v0
+        uses: anchore/sbom-action@v0 # v0
         with:
           format: spdx-json
           artifact-name: sbom.spdx.json