[imglorp]

Yes, true, but at least the fire won't spread through this one point. Hopefully all of your upstreams can be persuaded to pin also.

[franktankbank]

Doesn't a single compromised action in the chain cause the whole to be fucked? Pinning the top level doesn't prevent any spread.

[teaearlgraycold]

Might want to vendor everything?

[lijok]

That’s the way to go indeed. We’ve done it, not difficult, just a bit of gruntwork to keep them updated when needed

[franktankbank]

I don't know what this means in this context.

[teaearlgraycold]

Make copies of the entire GitHub action dependency tree.