Don't assume release target_committish is always a SHA

[rtsao]

This may be the case if tags/releases are manually created (instead of using the release probot).