GitHub Actions' VM image doesn't match published source code (lists.reproducible-builds.org)