bump.yml: use shas from triggered sources