The article on hardening GitHub actions by @sebastian is worthy of a read by anyone that uses GitHub actions – or any CI/CD really. Really good to understand some of the possible weaknesses.
https://phpunit.expert/articles/hardening-github-actions-workflows.html