An annotated tag's object id is not the commit id, and this Docker action pulls
ghcr.io/pypa/gh-action-pypi-publish:<ref>. Only commit SHAs and version strings
exist there as image tags, so the previous pin resolved to no image at all.