There is zero information about who the heck WorkflowCI is or trust building before the big "INSTALL" call to action. This could be anyone simply asking for the keys to your Github kingdom. This is what Github says:
Install on your organization <your company org> @<your company org>
All repositories
This applies to all future repositories.
...with these permissions:
Write access to code
Read access to metadata and vulnerability alerts
Read and write access to administration, checks, commit statuses, deployments, issues, members, organization
projects, pages, pull requests, repository hooks, repository projects, and team discussions