Grype associate the commit ID with the wrong tag

**What happened**:

When we scan a github repository , grype found us an issue in one of our workflow file

```yaml
- name: Check for changed workflow files
id: changed-workflow-files
uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v46
with:
files: |
.github/workflows/**
```

If i do
```bash
grype --by-cve -o json my-private-repo/ | grype explain --id CVE-2025-30066
````

I got
```
CVE-2025-30066 from github:language:github-action (High)
tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
Related vulnerabilities:
- github:language:github-action GHSA-mrrh-fwg8-r2c3 (High)
Matched packages:
- Package: tj-actions/changed-files, version: e0021407031f5be11a464abee9a0776171c79891
PURL: pkg:github/tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891
Match explanation(s):
- github:language:github-action:CVE-2025-30066 Direct match (package name, version, and ecosystem) against tj-actions/changed-files (version e0021407031f5be11a464abee9a0776171c79891).
Locations:
- /private/tmp/my-private-repo/.github/workflows/grafana.yml
URLs:
- https://github.com/advisories/GHSA-mrrh-fwg8-r2c3
```

Here the issue is that it think that commit `e0021407031f5be11a464abee9a0776171c79891` reference the tag `45.0.7` , while in reality https://github.com/tj-actions/changed-files/commit/e0021407031f5be11a464abee9a0776171c79891 , it's `v47.0.1`
**What you expected to happen**:

Should not report this CVE as `v47.0.1` do not have this CVE

Reproduce the report with the shown workflow entry in .github/workflows/grafana.yml and the `grype --by-cve -o json ... | grype explain --id CVE-2025-30066` command. Compare the commit’s actual v47.0.1 tag with the reported 45.0.7 match; done means the CVE is no longer reported for that commit.

Written by the indexing model from the issue text.