GitHub's supply chain defense map catalogs nine shipped controls across npm and GitHub Actions — covering pwn-request blocking, trusted publishing, staged publishing, and the Dependabot cooldown — ...