Referencing a GitHub Action by a mutable tag (e.g. @v4) or branch instead of a full commit SHA lets whoever controls that tag run arbitrary code on the runner. A repointed or compromised tag becomes remote code execution in CI — the tj-actions/changed-files and reviewdog compromises worked this way. Highest risk on self-hosted runners with write/deploy credentials.
Pin actions to a full 40-character commit SHA (uses: owner/repo@<sha>) and note the version in a trailing comment. Enable Dependabot for action SHAs.