GitHub now automatically holds suspicious Actions workflows in public repositories, but maintainers must still review ...