The parser drops the # vX.Y.Z comment from uses: owner/repo@<sha> # vX.Y.Z, so the update check compares a 40-character SHA against the latest tag. They never match, so every run proposes an update to the version already pinned. Applying it rewrites @<sha> to @vX.Y.Z, which turns an immutable pin into a mutable tag.
Seen on stacksjs/stacks: pantry-pm/pantry/packages/action@bc2f374… # v0.11.65 → v0.11.65 (patch), 12 times. The resulting workflow-only PR then failed the whole run on a token without workflow permission.
Fix: compare a SHA pin through its comment. When it is really outdated, move it to the commit the new tag names and update the comment, so it stays a SHA. A pin without a comment is left alone.