Hacker News Reader

Doesn't a single compromised action in the chain cause the whole to be fucked? Pinning the top level doesn't prevent any spread.

Might want to vendor everything?

I don't know what this means in this context.

Make copies of the entire GitHub action dependency tree.

That’s the way to go indeed. We’ve done it, not difficult, just a bit of gruntwork to keep them updated when needed