no-issue
- The workflow runs in the pull_request_target context which has access to repo secrets even when triggered from a fork
- Pinned the GH Action to a specific version to guard against upstream changes to the Action which may abuse access to secrets