An action pinned by digest, and the bot that reads the tag

Third-party actions pinned to a commit, and a bump pull request that a human can actually review.

- uses: some-org/some-action@8c1f4a7e9b2d0e6a3f5c7b9d1e3a5c7b9d1e3a5c # v3.4.1

# and the bot's pull request body:
#
#   some-org/some-action v3.4.1 → v3.5.0
#   8c1f4a7 → 4a7e8c1
#
#   changed files: action.yml, dist/index.js
#   dist/index.js: +4,102 −3,880 (bundled, unreviewable)
#
#   release notes: [link]

The bundled dist file being unreviewable is the honest part of the summary and is the reason digest pinning matters — a tag can be repointed at any commit and a bundled artefact is not something anybody reads. Naming that in the pull request is more useful than pretending the review is meaningful.