On the topic of security, I am surprised there aren’t more safeguards for marketplace actions. I work in a larger organization and see that folks very much want to pull in actions that solve an immediate need without any type of vetting process. These actions are part of your build pipeline and can pose a substantial security threat.

Dependabot does not currently scan for outdated or vulnerable marketplace actions. It’s difficult for Enterprise Orgs to ensure only vetted actions are used. I think this area of GitHub is ripe for security and governance improvements.