1 independent sha-pinning listing the big search engines bury.
Pin your GitHub Actions. Prick holes in their supply chain security.