I learned recently about zizmor which audits your GH Actions.

TIL there is a GH-Action for it but it updates the GH Security Section with findings! 🤔

https://github.com/zizmorcore/zizmor-action#usage-with-github-advanced-security-recommended

https://kjaymiller.com/microblog/zizmor.html