Perhaps I did not explain clearly, your PR does not automatically run the workflow. Perhaps it would be more clear to imagine two files, a workflow file descri

Perhaps I did not explain clearly, your PR does not automatically run the workflow. Perhaps it would be more clear to imagine two files, a workflow file describing the CI steps and a permission file describing what can trigger the CI. The CI will use the permission file from the last trusted commit (which would also be the last commit that the CI was run on) but uses the workflow file of the current commit. In your case you create a PR that updates both the workflow and permissions file. The CI sees that the previous trusted commit requires that I, the repo owner has to manually submit unknown PRs to the CI. Seeing that your PR is malicious, I don't submit the PR to the CI. Now that I've layed it out explicitly I realise that the non intuitiveness comes from using git to track CI configuration in the same repo.