The files list seems to be unsorted, that causes action to return different hashes for the same pattern between runs.
Both single pattern with multiple files and multiple patterns with single match will be affected:
patterns: **/package-lock.json
patterns: |
package-lock.json
yarn.lock
Possible solution:
const files = (await getFiles(workdir, patterns, {gitignore, ignoreFiles})).sort()