Wiz's Oct 26 review of what still works against GitHub Actions makes two points worth checking in your workflows today:

• Script injection needs no checkout. A pull_request_target step like run: echo "${{ github.event.pull_request.title }}" runs an attacker's PR title as shell code, with the job's secrets. Move the value into env: (for example PR_TITLE: ${{ github.event.pull_request.title }}) and use "$PR_TITLE", quoted, in the script.
• Artifacts are still a bridge. An unprivileged pull_request build can upload attacker-made output that a privileged workflow_run job downloads and executes. Checkout hardening doesn't help, because nothing is checked out. Treat artifacts from fork-triggered runs as untrusted data: don't execute them, and don't give that job deploy secrets.

Quick audit: grep workflows for ${{ github.event. inside run: blocks, and for workflow_run jobs that call download-artifact and then run a script.