Use the PR sha for the correct file artifacts

Artifacts retrieved from the repository should be retrieved from the
correct HEAD sha. This undoes the commit d2a490 that ensured we always
used to the script on main.

.github/workflows/update-release.yml

@@ -31,6 +31,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0 # We need the full history to compute the changelog
+          ref: ${{ inputs.head-sha }}
 
       - name: Install Python
         uses: actions/setup-python@v4