Note that if you have self-hosted runner and if some of the environment variable or state of execution are carried over between runs - you should not even reply or comment on any malicious PR.. The reason is - if they have pull_request_review_comment action workflow inside the fork...

well guess what? it bypasses even your "Require approval for all outside collaborators" flag in your repo setting and trigger it on your self-hosted runner anyway...

This was brought up in recent BlackHat24:

https://github.com/AdnaneKhan/ConferenceTalks/blob/main/Blac...

And yes - it's another "Github won't fix"