For the target repo, only on the pull_request event[0] would run; nothing is being `push`ed to the repo, so it doesn't allow something like pushing an actions s

For the target repo, only on the pull_request event[0] would run; nothing is being `push`ed to the repo, so it doesn't allow something like pushing an actions script that exfiltrates secrets. 0: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request https://docs.github.com/en/actions/using-workflows/events-th...