Update release pipeline versions

Author: pcj

.github/workflows/publish.yml

@@ -20,7 +20,7 @@ on:
 
 jobs:
   publish:
-    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@c316f1611511a40423572303f66c80bb30bfe2f8 # v1.4.1
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.4.1
     with:
       tag_name: ${{ inputs.tag_name }}
       registry_fork: stackb/bazel-central-registry

.github/workflows/release.yml

@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   release:
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@1d798ff015ed0696433e01e2c3ccbb2abefadad7 # v7.7.0
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.7.0
     with:
       release_files: jvm_image-*.tar.gz
       prerelease: false

RELEASING.md

@@ -31,9 +31,19 @@ The tag starts `.github/workflows/release.yml`. If BCR publication needs to be
 retried without recreating the GitHub release, run the **Publish to BCR**
 workflow manually and supply the existing tag.
 
+If the source-archive attestation itself must be regenerated, run the full
+**Release** workflow with the existing tag instead. The publish-only workflow
+regenerates `source.json` and `MODULE.bazel` attestations, but not the release
+archive attestation.
+
 The BCR pull request is intentionally opened as a draft. The token owner must
 mark it ready for review, which serves as the maintainer approval recognized by
 the BCR.
 
+The two attestation-producing reusable workflows are referenced by release tag,
+not commit SHA. BCR's SLSA verifier requires the builder attestation to contain
+a `refs/tags/...` workflow ref and rejects a bare SHA as an unknown ref type.
+Other third-party Actions remain pinned by commit SHA.
+
 The release preparation step rejects malformed tags and refuses to publish
 until a `LICENSE`, `LICENSE.txt`, or `LICENSE.md` file exists.