FYI: Using the action like in the example would make you vulnerable to pwn requests

[ST-DDT]

The current run-nothing action is safe, but running anything in there that uses the source code is dangerous as it uses elevated permissions.
I'll recommend rewriting/removing the checkout or raising awareness by adding a comment.

test-repo/.github/workflows/test-outputs.yml

Lines 12 to 13 in 3094c8b

	- name: Checkout
	uses: actions/checkout@v4

• https://securitylab.github.com/research/github-actions-preventing-pwn-requests
• Description seems dangerous actions/labeler#755 (comment)