GitHub actions encourages using mutable references for “workflows”, so the inputs used during the build process can change before and after the build. That see

GitHub actions encourages using mutable references for “workflows”, so the inputs used during the build process can change before and after the build. That seems like an obvious vector for doing something behind your back.