In my own project we actively cut down on external CI deps (non-official github actions) as much as possible, it seems incredible unsafe

When we do use an external dep (like in two places for our massive project) we pin it to a specific GIT sha that we manually curated to not contain anything weird