Credential theft and image poisoning via mutable action

Supply-chain exposure in Red Hat Quay 3 allows remote attackers to steal registry credentials or publish malicious builder images. The quay-builder-qemu build-and-publish workflow invokes a third-party action from a mutable master branch after logging in to the registry, exposing the push token and default GitHub token to changed action code. Exploitation requires control of that upstream action or branch; a poisoned builder image can then reach Quay build executors.