gh-token VS action-get-latest-tag

I recently built this: (https://github.com/Link-/github-app-bash) as a quick way to generate access tokens to use with GitHub's APIs. Now I can use tokens with a limited scope, and lifetime when I test which is safer than using a personal access token that never expires. It's fully written in bash and does not have many dependencies. It's quick does the job.

This certainly came as a surprise to my team today.

We operate some number of repositories and the majority of them use https://github.com/actions-ecosystem/action-get-latest-tag - or more specifically, a fork of that repo which more or less works the same way.

Midday today our CI/CD started failing. We must have hit this so soon because the `apk add git` in that Dockerfile grabbed the new git version. Evidently the SID that ultimately executed the git command inside the included actions' dockerfile was not the same as the one that owned `/github/workspace` on the runner.

We were able to patch around using the new `safe.directory` option, but I'm curious to see if there's more fallout since CI/CD environments in particular had benefit from this sort of shared repository.