Very interesting read! One thing I don't understand is this:
The ActionMutator targets custom GitHub Actions by force-pushing trojanized commits to their semver tags. Any downstream workflow that references uses: owner/action@v1 gets the compromised version next time it runs.
Does it mean we should not use Semver when referring to the actions? We should be using the action hash instead?
Or maybe the Semver with a version including the patch level ?