If you run #zizmor on your on repo and fix the github actions there, you gain just about nothing if your entire dependency tree doesn't do the same. Malicious actors will stop targeting your app and target the 200+ softer targets in the dependency tree.
Post
May 3, 2026