Verify GitHub automation against exact documented event and security semantics

When reviewing or implementing GitHub Actions, webhooks, or REST API integrations, consult the supplied or official GitHub documentation and preserve exact details. Check supported activity types, trigger context, SHA/ref behavior, default-branch requirements, token permissions, fork behavior, secret availability, API scopes, status codes, and security boundaries. Treat attacker-controlled contexts and untrusted workflow artifacts or code as unsafe, especially with privileged triggers such as workflow_run or pull_request_target. Support conclusions with concrete repository evidence and command results rather than assumptions.