How to Harden GitHub Actions: The Unofficial Guide

This guide analyzes recent GitHub Actions supply-chain incidents (including a cryptominer injection and the tj-actions compromise), explains common workflow vulnerabilities and poisoned pipeline execution scenarios that enable token/secret theft and lateral abuse, and provides organization- and repository-level hardening recommendations (least-privilege tokens, allowlisting/verifying Actions, branch protection, secrets management, runner isolation) plus tooling to help audit and mitigate these risks.