GitHub Actions Has a Package Manager, and It Might Be the Worst

The blog post critiques GitHub Actions' new package manager for neglecting fundamental supply chain security practices, highlighting the lack of features like lockfiles, integrity verification, and transitive pinning.