From https://community.plone.org/t/remove-rtd-pr-preview-build-workflow-file-and-a-warning-about-github-actions-v7/23083.
I would also suggest that anyone using either pull_request_target or workflow_run in their workflows review them to ensure they're not vulnerable. See GitHub - actions/checkout: Action for checking out a repo · GitHub for details.
See
Because of the use of an ancient version of actions/checkout, this project is not vulnerable, and therefore not a security issue at this time. But if you do upgrade to v7, you'll find that workflows that use workflow_run will be blocked, unless you override it.
From https://community.plone.org/t/remove-rtd-pr-preview-build-workflow-file-and-a-warning-about-github-actions-v7/23083.
See
ploneconf.org/.github/workflows/deploy.yml
Line 5 in f5f2943
Because of the use of an ancient version of actions/checkout, this project is not vulnerable, and therefore not a security issue at this time. But if you do upgrade to v7, you'll find that workflows that use
workflow_runwill be blocked, unless you override it.