A compromised action can be prevented by always pinning the action by SHA or ensuring the repository uses immutable releases and pinning to a release. Tip: enable "Require actions to be pinned to a…

Updating all of the repositories I am part of to use npm stage publish, this is important! Don't forget to also update your OIDC environment to only allow stage publish from OIDC

Been working on a trusted-publishing skill after seeing all of this. I've really been going at it on all repositories within urql-graphql, preact, 0no-co, ... to ensure the publishing flows are safe.