A zero-dep CLI that scans your GitHub Actions for the mistakes that actually get repos compromised (opens in new tab)

Your CI workflow is the softest target in your repo. It runs automatically, it has a GITHUB_TOKEN that can push commits, and it can read your secrets. The supply-chain attacks of 2025 — reviewdog, tj-actions/changed-files — all came in through the same unlocked door: a workflow that trusted a mutable action tag, so when the upstream tag got repointed at malicious code, every consumer ran it with full privileges. The uncomfortable stat: 71% of repositories never pin their actions to a commit S...