Pinning GitHub Actions to a tag is mass negligence and we all just watched it happen

Many of your CI pipelines can easily be manipulated to execute any code with a single force-push. And you likely unwittingly enabled this yourself. I certainly did. What Actually Happened In March 2026, LiteLLM was breached using a poisoned Trivy GitHub Action. The threat actor didn't publish a new, obviously-malicious action under a typo-squatted name. They force-pushed malicious code to existing release tags that teams were already using. In other words, the @v1 or @v2 that you pinned to? It's