In a workflow, I have
uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
It got converted to
uses: dawidd6/action-download-artifact@v3.1.4
Verify then complains
gh actions-lock --verify
✗ 1 of 6 workflows failed verification
✗ Unreachable pin dawidd6/action-download-artifact@v3.1.4
pinned b6e2e70617bc is not an ancestor of 09f2f74827fd — lockfile may have been tampered with
↳ https://github.com/dawidd6/action-download-artifact/releases
! investigate immediately — verify the lockfile entry against upstream history
In a workflow, I have
It got converted to
Verify then complains
gh actions-lock --verify ✗ 1 of 6 workflows failed verification ✗ Unreachable pin dawidd6/action-download-artifact@v3.1.4 pinned b6e2e70617bc is not an ancestor of 09f2f74827fd — lockfile may have been tampered with ↳ https://github.com/dawidd6/action-download-artifact/releases ! investigate immediately — verify the lockfile entry against upstream history