GitHub Actions has the possibility to run on workflow event pull_request_target.
This event is known to be unsafe since at least 2021 and GitHub has "tried" multiple times to fix this. However even now - 5 years later - there is still no option to disable this security hole.
This idiotic stuff just compromised Trivy, which causes a massive cleanup action and I will not let it happen to us.
TODO:
- Create a workflow that searches for occurrences of
pull_request_target in our workflow and opens an issue and notifies me when this is the case