SG-034: GitHub Actions Risky Trigger

Severity: HIGH

pull_request_target with untrusted code execution

Fires when

• A workflow uses the pull_request_target trigger
• A workflow checks out an untrusted PR head ref/sha
• A workflow step echoes a secret
• A run command interpolates untrusted PR/issue input

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.