Comment by bagels

If you're still using github workflows with your own action runner, you are still susceptible.