Add security tip on GitHub Actions supply-chain protection

@zhoushuming073-cell · 18 October 2026 · 3 points

Lock your GitHub Actions dependencies, use a workflow dependency lockfile or pin third-party actions to verified full-length commit SHAs to reduce supply-chain risks. (@zhoushuming073-cell)

Contributed to the CyberSecTOBER open-source library under CC BY 4.0. View on GitHub · Pull request #130