CI supply chain security aims to prevent a pipeline from serving as an attack vector. It consists of pinning third-party actions to a commit SHA, limiting permissions, protecting secrets from external pull requests, updating dependencies and not running untrusted code with elevated rights.
Example
uses: actions/checkout@<sha-du-commit>