Unmasking GitHub Actions' Critical Weakness: The Orphaned Commit Attack

For years, SHA pinning has been considered the gold standard for securing GitHub Actions, but the Trivy compromise reveals a fundamental architectural flaw: orphaned commits from forked repositories can be reached through GitHub's API despite not existing in the main branch. This attack exposes how widely trusted security measures can be bypassed, putting countless production CI/CD pipelines at risk of silent supply chain compromise.