For me i feel the attack vector is Public repo > infect by merge > github runner picks up and gets infected > and github action (from a repo) that then runs o

For me i feel the attack vector is Public repo > infect by merge > github runner picks up and gets infected > and github action (from a repo) that then runs on runner getw effected