Actions pinned to full commits, no token left in the checkout, no binaries
from a fork's pull request among the artifacts, the version passed through the
environment, an audit of the NuGet packages, time limits, one release at a
time with checksums and never over another commit's release, and Dependabot
for the actions and packages.
