Prefer evidence-based security reviews of GitHub release automation

When reviewing GitHub Actions or release tooling, inspect the actual workflows, implementation, tests, API behavior, permissions, and live-state checks before reaching a conclusion. Treat GitHub contexts, event payloads, issue metadata, actors, and checked-out code as potentially attacker-controlled. Verify trusted-code checkout, least-privilege credentials, exact actor and event provenance, allowlisted bot paths, self-approval prevention, and revalidation immediately before privileged transitions. Expect authorization to fail closed when permissions, attestations, current labels, titles, or event bindings cannot be verified. Support findings with concrete file/line or test evidence and avoid relying on generic bot identity or stale workflow state.