Fixes for Zizmore findings

Author: TristonianJones

.github/workflows/release.yml

@@ -35,8 +35,9 @@ jobs:
 
       - name: Determine Release Tag
         id: tag
+        env:
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
         run: |
-          TAG="${{ github.event.release.tag_name || inputs.tag }}"
           echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
 
       - name: Build REPL Binaries and Packages
@@ -92,7 +93,7 @@ jobs:
           sha256sum * > checksums.txt
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@d7d6bc7722e3dedc6a805720a11fad7373c5a8de # v3.8.1
+        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
 
       - name: Sign Checksums with Sigstore Cosign
         run: |