Hacker News Reader

No the "v4" tag gets updated from v4.1 to v4.2 etc as those minor versions are released. They are branches, functionally.

Exactly. And that's what happened here -- the bad actor changed all of those version tags to point to their malicious commit.

Correct me if I'm wrong, but you would be able to prevent this specific issues with the "Rules" in order to block updates of tags; https://github.blog/news-insights/product-news/github-reposi...

Yeah but no GitHub Action is going to do this because updating tags is the de facto mechanism for releasing patches for those repositories.

Wow, thank you (and the other person that pointed this out to me). That's madness.

You can pin actions to a git sha to prevent this but people generally do not. Action authors would prefer their updates be picked up automatically.