containerize all the things...Nix, Podman, Docker. It's not a big hassle once you get through the initial steps.

Would be good to see projects (like those recently effected) nudging devs to do this via install instructions.

Yep. This is what I do. I edit and run my code in a container. That container cannot access my ssh keys or publish to GitHub. I review all changes, and manually commit / publish on my host. It’s not perfect, but that plus vendoring my dependencies goes a long way towards mitigating these kinds of things.