[MadVikingGod]

[flagged]

[woodruffw]

The action in question is not in the repository; it's retrieved at runner execution time. I think that's an important distinction.

[lixtra]

It’s like putting

curl -sSL https://example.com/install.sh | sh

In your action. For sure happens.