Thanks @silvanocerza! What would you think about adding a v1 ref to arduino/create-changelog, then using that ref here instead of pinning the patch version. That way, this workflow (and any others) using the arduino/create-changelog action can automatically benefit from any new non-breaking releases of the action.

This approach is mentioned as best practices in the GitHub Actions docs:
https://docs.github.com/en/actions/creating-actions/about-actions#using-release-management-for-actions
They seem to lean toward using a tag for this, but also mention the option of using a branch instead (any Git ref can be used). I somewhat prefer the branch approach because I have always though of a tag as an immutable marker for a specific point in the commit history. I have seen a couple of prominent actions that use the branch approach (though certainly many others use tags):

• https://github.com/octokit/request-action
• https://github.com/ruby/setup-ruby

Yeah, I like that. I'll push a v1 branch on the create-changelog repo and update this PR.