I want to point out my latest example of a supply chain attack that's going on all the time: GitHub Actions GitHub Actions uses tags to represent it's versions

I want to point out my latest example of a supply chain attack that's going on all the time: GitHub Actions GitHub Actions uses tags to represent it's versions, which would be great if GitHub locked down tags. They don't. Every GitHub Action I encountered in my first foray into the technology a couple weeks ago included a "Publish" script - that as it's first action, deleted a tag! And then reused that tag. This is absolutely a supply chain attack, if not a malicious one.