Def a real concern. If anyone is interested to mitigate it yourself, these are helpful :) https://docs.github.com/en/actions/creating-actions/about-custom-act

Def a real concern. If anyone is interested to mitigate it yourself, these are helpful :) https://docs.github.com/en/actions/creating-actions/about-custom-actions#using-a-commits-sha-for-release-management https://docs.github.com/en/actions/creating-actions/about-cu... https://github.com/dependabot/dependabot-core/issues/2835 https://github.com/dependabot/dependabot-core/issues/2835 https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions https://github.com/zgosalvez/github-actions-ensure-sha-pinne... https://github.com/timmeinerzhagen/dependabot-sha-comment-action https://github.com/timmeinerzhagen/dependabot-sha-comment-ac...