“They tell you if you accept pull requests, you need to treat it like untrusted input and you need to use the workflows to segment them and use the right type of events like Pull request, there are 2 types of events trigger the workflow.”

Transcript evidence from François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages.