GitHub Actions Is the Weakest Link

GitHub Actions is where most startups' software supply chain quietly breaks - third-party actions running with write tokens, unpinned to any commit. This is the one-hour hardening pass: five concrete pins you can ship in an afternoon. Drop your email and I'll send it the moment it's live.