Use sha and ref for upload

Author: ciroque

.github/workflows/build-and-sign-image.yml

@@ -9,17 +9,13 @@ on:
     branches:
       - "main"
 
-  push:
-    branches:
-      - "fix-trivy-scan-upload"
-
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
   build_and_sign_image:
-#    if: ${{ github.event.pull_request.merged }}
+    if: ${{ github.event.pull_request.merged }}
     runs-on: ubuntu-latest
     permissions:
       contents: read