Comment by tomeraberbach

Mildly ironic that the quickstart suggests starting with an unpinned action

gjtorikian/gh-actions-lockfile@v1

Presumably since it has to run first it must run unpinned?