The Invisible Threat: GitHub Actions as the Weakest Link in Supply Chains

Systemic vulnerabilities in GitHub Actions, particularly the pull_request_target feature and lack of integrity hashes, are being actively exploited to compromise major open-source projects. This highlights a critical need for developers to move beyond default configurations and treat CI/CD workflows as high-risk infrastructure.