2 skills after filtering
Pinned, non-root, scanned and signed images from least-privilege GitHub Actions
Small, cached, non-root images and a lint-test-build-scan-deploy pipeline