Comment by blibble

it's even worse that that

the CI system itself encourages you to import random third party code into your CI workflow, based on mutable tags

which then receives full privileges

the entire thing is insane