In my post From GitHub Repo to Live Website (and Then Auto-Deploy), I built a workflow that deploys my site on every push. Magic. Then I stopped and asked myself: Who else can make that workflow run? A GitHub Actions workflow is more than an automation script. It can execute code, access repository secrets, interact with external services, and receive permissions to modify your repository. If an attacker finds a way to influence what it executes, the impact can extend far bey