Description

Intermittent build failures in workflows calling sigstore/gh-action-sigstore-python, depending on the Python build version being used. This can occasionally block our releases, depending on the repository content and wider CI context.

Version: sigstore/gh-action-sigstore-python@v3.1.0 [latest release]

It looks like the action is trying to install dependencies with --require-hashes mode, but one of the dependencies (importlib_resources~=5.7) doesn't have a pinned version with ==.

I'm calling with: sigstore/gh-action-sigstore-python@f832326173235dcb00dd5d92cd3f353de3188e6c

Here's the error:

ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
    importlib_resources~=5.7 from https://files.pythonhosted.org/packages/7a/68/bd9dd6bbf06772c7accce77d0354d783333fbe712a60b08fc13540c05422/importlib_resources-5.13.0-py3-none-any.whl (from sigstore==4.1.0->-r /home/runner/work/_actions/sigstore/gh-action-sigstore-python/f832326173235dcb00dd5d92cd3f353de3188e6c/requirements/main.txt (line 481))