build1 distinct publisher
The runner holds your deploy keys, and nobody put it in the scanning program
Codecov in 2021 and tj-actions/changed-files in March 2025 failed the same way: trusted third-party code running with pipeline privileges on a push nobody on your team made.
Publishers:dev.to
Reality
- Evidence52
- Adoption24
- Hype gap+18
- Incentives34
- Confidence55