GitHub Actions Approval Holds: A Maintainer Security Checklist
GitHub now automatically holds some suspicious Actions runs in public repositories. Here is what the safeguard covers, what it misses, and how maintainers should review a blocked workflow.