kmp-ci-github-actions

No malware or direct data theft is present in the supplied fragment. The workflow has a meaningful credential-exposure risk because it runs a PR-head script after checkout with persisted credentials potentially available. Set persist-credentials: false and review or otherwise constrain the script before using this workflow with write-capable credentials. The referenced script is not supplied, limiting the assessment.