Securing the open source supply chain across GitHub
github.blog