Question
Just wondering why the sigstore/rekor-monitor/.github/workflows/reusable_monitoring.yml is using dawidd6/action-download-artifact instead of actions/download-artifact. While the former does not look problematic, I'm a bit puzzled you'd use a third-party alternative when there is a first-party option available.
I briefly looked at the commit and issue/PR history but didn't manage to find a motivation.