Reviews GitHub Actions workflows before you merge them: who can make each one run, what of theirs it executes, and what that reaches - the token, the secrets, the cloud role, the runner, the release. Catches pwn requests under pull_request_target and workflow_run, script injection from titles, bodies and branch names, over-broad permissions, unpinned actions and loose OIDC trust, then gives the smallest YAML changes that close each path and what to rotate if it is already live.