Merge verified download action while retaining updated upload pin

Author: karlwaldman

.github/workflows/publish.yml

@@ -125,7 +125,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: verified-pypi-package
           path: ${{ runner.temp }}/release-artifact
@@ -168,7 +168,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: verified-pypi-package
           path: ${{ runner.temp }}/release-artifact
@@ -227,7 +227,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: verified-pypi-package
           path: ${{ runner.temp }}/release-artifact

tests/test_release_readiness.py

@@ -136,7 +136,7 @@ def test_oidc_publisher_consumes_only_the_verified_artifact() -> None:
 
     assert "Verify release tag matches package version and protected main" in workflow
     assert "actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9" in workflow
-    assert "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" in workflow
+    assert "actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333" in workflow
     assert "pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33" in publish
     assert "id-token: write" in publish
     assert "sha256sum -c artifact.sha256" in publish