Actions lockfiles prevent this. They won't allow you to lock an impostor commit, which is the right default.

(The previous way to provide general actions immutability, i.e. hash-pinning, had this issue and thus required additional checks.)