A walkthrough of the specific changes I made to harden my workflows against supply chain attacks via third-party GitHub Actions and npm, plus a prompt you can use to run the same review on your own repo.
After setting up the update-theme workflow to open PRs instead of pushing directly to main, I immediately found it wasn't actually allowed to do that. Then it complained about Node.js 20 actions being deprecated. Here's how I fixed both.
How a Hugo version mismatch broke my Tugboat preview build —and how I fixed the workflow to catch this automatically and add a human review step in the future.
During my visit to Harry P Leu Gardens after Florida DrupalCamp, I think I may have found the source of inspiration for many a git-based workflow.
Recording now available for my FLDC 2026 talk, Build Your First CI/CD Pipeline
