GitHub Actions kindly shares secrets

Same story, different day, as two compromised maintainer accounts let thieves plant credential-stealing workflows across tens of thousands of repositories. This delightful mess landed square on everyone trusting open-source maintainer accounts without a second thought. Shielding our estates from this rampant nonsense apparently requires vetting rogue workflows and praying maintainers actually secure their logins. Why do we even bother with supply chains when we happily automate the theft of our own corporate secrets?