There is a low hanging fruit in making GitHub Actions more secure (anyone from GitHub here?):
- Forbid (or at least warn about) shell interpolation in composite actions and guide to using environment variables instead
- Warn unless all external actions are pinned by git commit (with customizable exceptions)
- Warn unless all used docker images are pinned by digests
