What can run when you open a GitHub repo? A practical CI hook audit

A repository can configure commands that run before you've deliberately run its test suite. The trigger might be an npm installation event, a trusted VS Code folder-open task, a devcontainer lifecycle