Standard CI security scanners fail to detect attack scenarios in GitHub Actions through their structural distribution across multiple workflows and external actions, necessitating complementary governance measures.