Latest
Who Moved My Tag?
A workflow that uses some/action@v4 runs whatever v4 points to when the job starts, and anyone with push access to that repository can change it. Four real GitHub Actions compromises, three of them CVEs, show what happens when a tag gets moved, why pinning to a full commit SHA protects you, where a SHA still leaves gaps, and how to pin without making updates painful.
18 min read
·
October 24, 2026