Everyone knows the drill: pin your GitHub Actions uses: to a commit SHA so a compromised tag can't rug-pull your CI. Done, right? Not quite. There's a depth problem nobody checks. The tj-actions incident (CVE-2025-30066) is the textbook case: the compromise reached victims through reviewdog, which referenced the compromised action. Pinning reviewdog itself wasn't enough — the hole was one level deeper, inside the dependency of a pinned dependency. "You pinned your Actions, but the Ac...