The complete GitHub Actions security checklist

This document is a practical GitHub Actions security checklist that describes how workflow misconfigurations and mutable dependencies have enabled large supply-chain campaigns and targeted exploits; it summarizes observed attacks (e.g., Trivy, tj-actions, Ultralytics, Shai-Hulud), outlines common dangerous patterns (pull_request_target, workflow_run, untrusted interpolation, unpinned actions, long-lived secrets, self-hosted runners), and provides concrete mitigations and tooling recommendations to reduce exposure.