A lot of orgs “secured” GitHub Actions by pinning to tags, which is a fun strategy if you enjoy finding out your trusted scanner now has initial access. CI trust is getting weird in ways most runbooks still don’t cover.