Reference tag with @ instead of :

Signed-off-by: Brend Smits <brend.smits@philips.com>

.github/workflows/ci.yaml

@@ -176,7 +176,7 @@ jobs:
           echo '${{ secrets.COSIGN_PRIVATE_KEY }}' > cosign.key
           IFS=,
           for t in ${TAGS}; do
-            cosign verify --key cosign.pub ${{ matrix.repo }}:${t}
+            cosign verify --key cosign.pub ${{ matrix.repo }}@${t}
             syft ${{ matrix.repo }}:${t} -o spdx-json > sbom-spdx.json
             cosign attest --predicate sbom-spdx.json --type spdx --key cosign.key ${{ matrix.repo }}@${t}
             cosign verify-attestation -o verified-sbom-spdx.json --key cosign.pub ${{ matrix.repo }}@${t}