People have been warning about giant security holes in GitHub Actions dependency but MS did nothing.