> I never reviewed anything under the .github directory and those are skipped here as well.

Shouldn't workflows be under review as well, considering the backdoor's presence and exploit flow in the build process?