Good coverage of the pull_request_target pitfall. Two additions worth considering: setting the org-level policy to require full-SHA pinning for actions (and letting Dependabot bump the SHAs) removes the 'convenient tag vs. safe SHA' tradeoff, and for deploys, an OIDC-issued short-lived cloud credential bound to a GitHub Environment with required reviewers is usually safer than any stored secret. Also, since a job-level permissions block replaces the workflow one, is there a lint (e.g. zizmor or actionlint) you'd suggest running in CI to catch jobs that silently inherit broader scopes?