I personally would recommend reviewing actions/checkout with a custom ref input instead. actions/checkout is the way to escape trust boundaries. In pull_request_target events that's fork -> upstream. But in workflow_dispatch events actions/checkout allows running in protected GH environments.
most of these github actions driven breaches are because of pull_request_target.
here's some tips of what to look for when reviewing your own workflows.
worth noting - it is safe, and necessary, when used correctly
🧵
