Having the maintainer trigger the CI job moves the problem elsewhere. Attackers will create new repositories (or take over existing ones) and create the PRs, fo

Having the maintainer trigger the CI job moves the problem elsewhere. Attackers will create new repositories (or take over existing ones) and create the PRs, for which they will trigger the CI jobs. The more apparent problem is that CI jobs can execute arbitrary code and are not limited wrt. their execution time. If limited, it would render them useless when used for cryptomining.