Mutable Tags, Immutable Risk: The GitHub Actions Supply Chain Flaw

GitHub Actions tag pinning creates a false sense of security—allowing any maintainer or attacker with write access to force-push malicious code to existing version tags. Since Git tags are mutable, this attack vector hits your CI/CD pipeline silently without notification, exposing secrets that carry more production access than application code itself. The solution is SHA pinning, which GitHub recommends but most organizations have ignored despite years of supply chain security investment elsewhere.