Always security-review GitHub Actions against documented trigger semantics

When creating, changing, or reviewing GitHub Actions, verify behavior against official GitHub documentation and treat all attacker-controlled contexts, refs, events, artifacts, caches, and inputs as untrusted. Check trigger-specific constraints such as default-branch requirements, rerun behavior, workflow-chain limits, OR semantics, and conclusion handling. Pay special attention to privilege boundaries where downstream workflows can access secrets or write tokens, and prevent untrusted code from reaching those credentials. Prefer explicit workflow file names where APIs or CLI commands accept workflow identifiers, pin third-party actions, validate inputs before minting tokens, and run the full test and lint suites before concluding the work is safe.